OAuth2Authentication

[ArtemKAF]

Describe the bug
There is no mark on the protected endpoint => swagger does not transfer the access token when accessing the protected endpoint.

To Reproduce

Expected behavior

Settings:
REST_FRAMEWORK = {
'DEFAULT_SCHEMA_CLASS': 'drf_spectacular.openapi.AutoSchema',
'DEFAULT_AUTHENTICATION_CLASSES': [
'oauth2_provider.contrib.rest_framework.OAuth2Authentication',
],
'DEFAULT_PAGINATION_CLASS': 'apps.utils.pagination.DefaultPagination',
'DEFAULT_FILTER_BACKENDS': [
'django_filters.rest_framework.DjangoFilterBackend',
'rest_framework.filters.SearchFilter',
],
}

OAUTH2_PROVIDER = {
"SCOPES": {
"read": "Read scope",
"write": "Write scope",
"groups": "Access to groups",
},
}

SPECTACULAR_SETTINGS = {
'TITLE': 'Your Project API',
'DESCRIPTION': 'Your project description',
'VERSION': '1.0.0',
'SERVE_INCLUDE_SCHEMA': False,
"SWAGGER_UI_SETTINGS": {
"swagger": "2.0",
"deepLinking": True,
"filter": True,
"persistAuthorization": True,
},
'OAUTH2_FLOWS': ['password'],
'OAUTH2_AUTHORIZATION_URL': 'auth/authorize/',
'OAUTH2_TOKEN_URL': 'auth/token/',
'OAUTH2_REFRESH_URL': 'auth/revoke_token/',
'OAUTH2_SCOPES': 'read write groups',
'SWAGGER_UI_OAUTH2_CONFIG': {
'clientId': env.str('OAUTH2_CLIENTID'),
'clientSecret': env.str('OAUTH2_CLIENTSECRET'),
'appName': env.str('OAUTH2_APPNAME'),
},
}

[tfranzel]

Hi, pretty sure this works if setup properly. Your settings alone are not enough to judge the situation. Have a look at the test implementation. You need both authentication_classes and permission_classes for this to work.

https://github.com/tfranzel/drf-spectacular/blob/master/tests/contrib/test_oauth_toolkit.py

https://github.com/tfranzel/drf-spectacular/blob/master/tests/contrib/test_oauth_toolkit.yml

[ArtemKAF]

Thanks for the explanation. What needs to be done to make the feature using OAuth2 without native django-oauth-toolkit permissions available not only in DRF, but also in drf-spectacular?

[tfranzel]

sry I don't really understand what you are saying. As far as I can see, you are using django-oauth-toolkit and it requires you to use permission_classes.

If you are doing some custom stuff there, you would need to write custom extensions for it: https://drf-spectacular.readthedocs.io/en/latest/customization.html#specify-authentication-with-openapiauthenticationextension