Python Social auth authentication via access-token fails

Question

I am currently developing a serverbackand with Django (1.7) that should handle authentication via social Networks by using python-social-auth. I followed the Tutorial on this site, which describes the process for a simple Webapp. This worked perfectly for Google and Twitter login.

Since the Server should be just a REST-FULL Backend I decided to get the Access-Token on the client side and send it to the server. The server than will authenticate with it. This process should be no problem and is even given as an example in the docs of python-social-auth.

However if I do set everything up I will receive an error that says: "Backend not Found 404".

Here a minimal part of the project:

settings.py: (I also included API_KEY and SECRET)

AUTHENTICATION_BACKENDS = (
   #'social.backends.facebook.FacebookOAuth2',
   'social.backends.google.GoogleOAuth2',
   'social.backends.twitter.TwitterOAuth',
   'django.contrib.auth.backends.ModelBackend',
)

views.py (for the authentication view)

from django.contrib.auth import login

from social.apps.django_app.utils import psa

@psa('social:complete')
def register_by_access_token(request, backend):
    token = request.GET.get('access_token')
    user = request.backend.do_auth(request.GET.get('access_token'))
    if user:
        login(request, user)
        return 'OK'
    else:
        return 'ERROR'

This i copied strait from the docs and only changed backend.do_auth to request.backend.do_auth. This seems to be an error in the docs.

urls.py:

...
url(r'^register-by-token/(?P<backend>[^/]+)/$', 'register_by_access_token')
...

Also as suggested in the docs.

I just tried to get this working just for google-oauth because there is a simple js-lib that gives you the access-token. This also worked quite nice and I send a request to

GET http://localhost:8000/register-by-token/google-oauth2/<access-token>/

As described above the return was a 404 Backend not found. I did a little bit of debugging and found out that the error is raised in the login function not the do_auth() function of the backend. Therefor the actual authentication process works. I also tried using a random generated string as a token and got an according error, that the user cannot be authenticated.

The funny thing is that the user even has a property backend which holds 'social.backends.google.GoogleOAuth2' as it should.

Thank you if you stayed with me for the long post, and I hope someone has an idea what could be wrong :). Looking forward to your answers.

Answer 1

In you register_by_access_token view, you are getting access_token in GET params

user = request.backend.do_auth(request.GET.get('access_token'))

and url you defiend is:

url(r'^register-by-token/(?P<backend>[^/]+)/$', 'register_by_access_token')

So you need to request something like:

GET http://localhost:8000/register-by-token/google-oauth2/?access_token=<access_token>

whereas, you are doing:

GET http://localhost:8000/register-by-token/google-oauth2/<access-token>/

You are passing access_token in url params, which is wrong.