Processing of claim mappings
Wondering how best to handle this a situation where the claim data needs to be transformed into something useable. By default, Microsoft AD sends Object GUIDs (UUIDs) as base64 encoded strings in little-endian byte order.
In this example, this was the only place for use to convert / transform that GUID into something usable.
import base64
import uuid
from django_auth_adfs.backend import AdfsAccessTokenBackend
class CustomAdfsAccessTokenBackend(AdfsAccessTokenBackend):
def validate_access_token(self, access_token):
claims = super().validate_access_token(access_token=access_token)
# Transform base64 objectGUID to a legit UUID
if claims['objectGUID']:
claims['objectGUID'] = uuid.UUID(bytes_le=base64.b64decode(claims['objectGUID']))
return claimsThis needs to be transformed / converted before create_user as it's needed by custom create_user method.
One idea is allow a person to set a callable on the mappings:
import uuid
def transform_objectguid(value):
return uuid.UUID(bytes_le=base64.b64decode(value)
'CLAIM_MAPPING': {
'first_name': 'FirstName',
'last_name': 'LastName',
'email': 'Email',
'phone_number': 'TelephoneNumber',
'ad_object_guid': {
'name': 'objectGUID',
'transform': transform_objectguid
},
}Another idea is a post_validate_access_token_hook:
import uuid
def post_validate_access_token(claims):
# Transform base64 objectGUID to real UUID
if claims['objectGUID']:
claims['objectGUID'] = uuid.UUID(bytes_le=base64.b64decode(claims['objectGUID']))
return claims
'CLAIM_MAPPING': {
'first_name': 'FirstName',
'last_name': 'LastName',
'email': 'Email',
'phone_number': 'TelephoneNumber',
'ad_object_guid': 'objectGUID'
}
'POST_VALIDATE_ACCESS_TOKEN_FUNCTION': post_validate_access_token # or 'dot.path.to.function' takes claims dict
How does funding with Polar work?
Pay now to fund the work behind this issue.
Get updates on progress being made.
Maintainer is rewarded once the issue is completed.
Backer
You're funding impactful open source efforts
Contributor
You want to contribute to this effort
Maintainer
You want to get funding like this too