Django and Azure Active Directory - Outsourcing Authentication to Azure AD / Setting up MFA

In this video, we look at how to use Azure Active Directory (AD) to handle authentication in a Django application.
We'll register a Django app in Azure AZ and will add users to our tenant. After this, we'll see how to configure Django to work with the ms_identity_web library, and will give users the ability to login and logout through Microsoft Identity Platform.
This is an example of using the OAuth2.0 Authorization Code Flow, with Azure AD as our external identity-provider.
We'll also see how to setup multi-factor authentication on Azure Active Directory, both with Security Defaults and with Conditional Access policies.
📌 𝗖𝗵𝗮𝗽𝘁𝗲𝗿𝘀:
00:00 Intro
02:24 Registering Django app with Azure Active Directory
05:43 Creating User in Azure Active Directory tenant
06:40 Adding Azure AD config file to Django project
08:38 Adding ms_identity_web settings to Django
10:45 Adding Login form from Azure AD
16:36 Adding SSL to Django Dev Server with runserver_plus command
21:12 Protecting routes with ms_identity_web login_required decorator
24:09 Django Sessions & Azure AD JWT Access Tokens
27:35 MFA with Azure Active Directory
29:42 Conditional Access Policies in Azure Active Directory
☕️ 𝗕𝘂𝘆 𝗺𝗲 𝗮 𝗰𝗼𝗳𝗳𝗲𝗲:
To support the channel and encourage new videos, please consider buying me a coffee here:
ko-fi.com/bugbytes
𝗦𝗼𝗰𝗶𝗮𝗹 𝗠𝗲𝗱𝗶𝗮:
📖 Blog: www.bugbytes.io/posts/
👾 Github: github.com/bugbytes-io/azure-...
🐦 Twitter: / bugbytesio
📚 𝗙𝘂𝗿𝘁𝗵𝗲𝗿 𝗿𝗲𝗮𝗱𝗶𝗻𝗴 𝗮𝗻𝗱 𝗶𝗻𝗳𝗼𝗿𝗺𝗮𝘁𝗶𝗼𝗻:
Register app in Azure AD: learn.microsoft.com/en-us/tra...
django_extensions RunserverPlus: django-extensions.readthedocs...
Security Defaults in Azure AD: learn.microsoft.com/en-us/azu...
Azure AD Conditional Access: learn.microsoft.com/en-us/azu...
#azure #python #django #azureactivedirectory #microsoftazure

Пікірлер: 73

  • @phillipgilligan8168
    @phillipgilligan81689 ай бұрын

    This is legit the best explanation I have seen and gave me confidence to implement this in my project. Thank you, as well for the technical breakdown, that was so useful!

  • @bugbytes3923

    @bugbytes3923

    9 ай бұрын

    Thanks a lot, really glad it was useful! Thanks for watching!

  • @yomonsbuzz4978
    @yomonsbuzz497810 ай бұрын

    under rated u deserve subs brother keep it up quality contentment

  • @bugbytes3923

    @bugbytes3923

    10 ай бұрын

    Thanks a lot!

  • @tlpf666
    @tlpf666Ай бұрын

    Thank you very much, very clear, very pleasant to hear.

  • @bugbytes3923

    @bugbytes3923

    Ай бұрын

    Thanks a lot!

  • @grant4458
    @grant44586 ай бұрын

    Great video. Thanks.

  • @bugbytes3923

    @bugbytes3923

    6 ай бұрын

    Thanks for watching!

  • @trosgate
    @trosgate Жыл бұрын

    This is dope. I love your channel for high level programming. 1. I am hoping that we could go a little bit further to configure multitenant applications too 2. In multitenant applications where domains might be unique and dynamic, how is the auth gonna be like? Until then, thumbs up from me

  • @bugbytes3923

    @bugbytes3923

    Жыл бұрын

    Thanks a lot for watching, glad you're enjoying the channel! Nice suggestions, I will consider these options!

  • @peterevance
    @peterevance Жыл бұрын

    Thank you very much!

  • @bugbytes3923

    @bugbytes3923

    Жыл бұрын

    You’re welcome, thanks for watching !

  • @piyushsonawane1861
    @piyushsonawane186111 ай бұрын

    Thank you so much sir ....very well explained ....love this video

  • @bugbytes3923

    @bugbytes3923

    11 ай бұрын

    Thanks very much!

  • @creepersonspeed5490
    @creepersonspeed54906 ай бұрын

    Sadly they have now removed the json sample from the tutorial...

  • @nicholas_eras
    @nicholas_eras Жыл бұрын

    What about django rest framework. My frontend is running on another server so I need to send the office365 uri from the backend, then i need to validate de token from the frontend

  • @ritiagarwal5535

    @ritiagarwal5535

    11 ай бұрын

    Did you get your solution ?

  • @jashanpreetsingh4750

    @jashanpreetsingh4750

    10 ай бұрын

    did you ? @@ritiagarwal5535

  • @frameff9073
    @frameff9073 Жыл бұрын

    thank

  • @bugbytes3923

    @bugbytes3923

    Жыл бұрын

    Thank you for watching!

  • @BrantScalan
    @BrantScalan8 ай бұрын

    This is a great video. Is there any chance you can talk about group claims and some of the other parameters so that we can map AAD groups to Django groups and permissions? It would be super helpful in implementing a true single sign on of Django with AAZ

  • @aalhommada5675
    @aalhommada56753 ай бұрын

    Thanks for the Explanation , I hope that you can add an update about the Azure Entra ID.

  • @THEATEAMRULES

    @THEATEAMRULES

    2 ай бұрын

    much needed

  • @THEATEAMRULES

    @THEATEAMRULES

    2 ай бұрын

    did you find some resources about it?

  • @aalhommada5675

    @aalhommada5675

    2 ай бұрын

    @@THEATEAMRULES I think if you understand AD , it will not ne difficult to get EntraID , it is kind of update

  • @routchenko
    @routchenko Жыл бұрын

    great video, just to round up, if you could just do an extension of the media file in azure storage would be lovely

  • @bugbytes3923

    @bugbytes3923

    Жыл бұрын

    Thank you Sacha! Yes, I'll do a video on storing the media files in Azure Blob storage soon.

  • @wearerunnersw.a.r5613
    @wearerunnersw.a.r561311 ай бұрын

    Great video. For some reason I had the ff issue: Django - Reverse for '' not found. '' is not a valid view function or pattern name I managed to resolve it by creating index and home views and urls. Do you know what could be the case?

  • @mice1973
    @mice197310 ай бұрын

    Very interesting. But if I need to give authorization via /admin, how can I make this directly via AD?

  • @BrantScalan
    @BrantScalan8 ай бұрын

    This is great content as usual. Do you have an example of, or could you create/show, how to use AAD groups and claims with Django groups for permissions and content access? It’s one things to SSO with AAD but in reality members of AAD groups would have rights that needs to used for Django content

  • @user-mq6bd2in1u
    @user-mq6bd2in1u Жыл бұрын

    So good thx! What's the baseline pricing for adding Azure AD to Django?

  • @pratikcharwad
    @pratikcharwad5 ай бұрын

    Azure Active Directory is now Microsoft Entra ID.

  • @kirteekumari3459
    @kirteekumari34597 ай бұрын

    Hi i am stuck at a part in the video, can it be possible because i only have a free account and free credit? Do i need to have a pay as you go pricing for getthing this done ? because it is not giving me the option to create a Entra ID with free subscription

  • @user-pz9yc8tr6b
    @user-pz9yc8tr6b8 ай бұрын

    Amazing video. Something I have wanted to do was convert my project to SSO against Azure AD. Could there be a follow on video about django permissions and Azure Groups and Group Claims in the Azure token? That is one road block I have for conversion. How do I protect content, model perms, with members from azure groups or mapping them to existing Django groups. Not sure how to do that or what should be done. Thank you

  • @user-wm8bo6st6f
    @user-wm8bo6st6f Жыл бұрын

    What if i am using deployed django app in azure webapp then what redirect URL i need to you?

  • @user-tv4pb2tu8y
    @user-tv4pb2tu8y6 ай бұрын

    I'm having a hard time operating the sign_out ! My app will work fine in a private browser, but not on a browser. I'm guessing the cache isn't deleted, or something so... I don't get redirected to the app after logging out with Azure AD. Any advice with this?

  • @charlesu49
    @charlesu4910 ай бұрын

    Excellent video!!! My question is, how do I access the users' other information like their email address? Seeing as request.identity_context_data provides username but no other personal information. And I will really appreciate a pointer on how this can be combined with a User model.

  • @pedrozuffo9516

    @pedrozuffo9516

    10 ай бұрын

    You can get more information by using request.identity_context_data._id_token_claims

  • @Johnnysus
    @Johnnysus Жыл бұрын

    Love your videos. How would you restrict certain views to different users within your tenant (i.e., supervisor views vs associate views)? Can this be done using Groups in Azure, or would you want to use social_auth and add to the social pipeline (which creates a user model in django database)?

  • @bugbytes3923

    @bugbytes3923

    Жыл бұрын

    Thanks John! Interesting question. With a User model, you can leverage Django permissions to restrict certain views, depending on permissions assigned to the user (or a group). The "permission_required" decorator can help you here. It would also be possible to do this via groups in the tenant. When you receive the response with the identity_context_data, you can look at the group(s) the user belongs to in the Azure AD tenant. You could then write a Python function and pass that to the "user_passes_test" decorator to restrict certain views. More on that decorator here: docs.djangoproject.com/en/4.2/topics/auth/default/#django.contrib.auth.decorators.user_passes_test

  • @izao.00
    @izao.005 ай бұрын

    is it possible to use this technique with django rest framework?

  • @monikasingh000
    @monikasingh0008 ай бұрын

    @bugbytes I applied Active directory login system in my django application and deployed it in Azure portal app services. It works fine for 1st week but then suddenly it start giving error "AuthSecurityError at /auth/redirect Failed to match request state with session state". I am using azure sql server as backend without creating models. Can you please help me to find out and resolve this issue?

  • @dinesh1782
    @dinesh17823 ай бұрын

    Great work,Can you please comment the documentation link which you followed

  • @cytixify
    @cytixify Жыл бұрын

    How can i add a profile for the user

  • @peterholzer98
    @peterholzer98 Жыл бұрын

    Excellent as always! When I deploy to Heroku or Railway I use to save the credentials in a .env file which i don't save to Github. How should i handle this with the aad.config.json file? It would be nice with some examples using MS Graph API as well. Thanks a lot!

  • @bugbytes3923

    @bugbytes3923

    Жыл бұрын

    Thank you for the suggestions Peter! Will look into the MS Graph API. For your aad.config.json file, definitely don't check the raw values into Github, as it contains your app's client secret which shouldn't be exposed.

  • @peterholzer98

    @peterholzer98

    Жыл бұрын

    @@bugbytes3923 I understand that but how would i store and retrieve the json file in a Heroku env var?

  • @XEQUTE
    @XEQUTE Жыл бұрын

    1. how would you do the same with flask ?? 2. also , flask vs django , is it really just micro framework vs a more robust one?

  • @bugbytes3923

    @bugbytes3923

    Жыл бұрын

    I've not really looked into Azure AD with Flask, but the library used in this video - ms-identity-web - can also be used with Flask. A sample repository is here: github.com/Azure-Samples/ms-identity-python-webapp Flask is a smaller framework as it offers less out of the box than Django, but you can add the utilities you need when you need them (forms, database connectors, etc).

  • @XEQUTE

    @XEQUTE

    Жыл бұрын

    @@bugbytes3923 Thanks for the reply ! Unfortunatlyey , the library cannot be used with conda ( to my knowledge , as its called azure-ilengthy dentity and the sample code uses Identity package ) I tried making an app with it ( quiz app ) but I can sign in with microsoft accounts too , but I get a code in return which I dont know what to do I set the client id , secret n all too. Lend some advice if you have some.Thanks in advance :D

  • @Pab12play
    @Pab12play6 ай бұрын

    Is this library ready for production?

  • @abhishekkaushik1635
    @abhishekkaushik1635 Жыл бұрын

    Hi, really nice tutorial. I have been following this tutorial & it works smoothly. But I am trying to add Azure AD to an existing DJANGO APP (created by someone else). whenever I am trying to login using SSO it reverts me back to LOGIN page. My guess is I am missing something & "request.identity_context_data.username" under HTML page is not woking as it should, hence reversing to login page. Can you please provide any advice on this or we test my theory of "request.identity_context_data.username" within app. Regardless, great video, you have one more subscriber.

  • @bugbytes3923

    @bugbytes3923

    Жыл бұрын

    Thanks for subscribing - really appreciate that! I'm not really sure, but a few things to check: * have you configured the redirect URI on Azure? It * In your view, what is the output of logging "request.identity_context_data"? * Are you using the ms_identity_web login_required decorator (and NOT the standard Django decorator)? I'd also make sure you've added the code at the bottom of this page ("Sign-in to a Django web app" section): learn.microsoft.com/en-us/training/modules/msid-django-web-app-sign-in/4-sign-in-users-to-django-web-app

  • @abhishekkaushik1635

    @abhishekkaushik1635

    Жыл бұрын

    @@bugbytes3923 Thank you entertaining my query, I will proceed with your comments. One last thing, is it necessary to do HTTPS thing? I mean I followed your example it is running fine without that, not sure why it is required

  • @jiya9643
    @jiya964327 күн бұрын

    can you please make video on django and azure AD by SAML

  • @jiya9643

    @jiya9643

    27 күн бұрын

    i was searching for video on django and azure using SAML, I saw this very informative, Thank you very much. Please do make video on django and azure using SAML

  • @mr_don_key
    @mr_don_keyАй бұрын

    request: could you redo this video with the current way of doing this? (the json variant is taken offline by msft)

  • @bugbytes3923

    @bugbytes3923

    Ай бұрын

    Thanks - yes, I'm planning to as I've had some requests. Will do this over the summer at some point.

  • @ramlakhankevat2666
    @ramlakhankevat26665 ай бұрын

    Please give me a Azure django sso documentation link

  • @rorisangsitoboli4601
    @rorisangsitoboli4601 Жыл бұрын

    Great work. Could you share your code please. I am trying to reproduce the entire tutorial but am failing to get the 'You are not signed in. Login' part. At least with your code I can investigate easily where I made mistakes and remedy that. When I run the server I just get the 'Hello World' text i intended but no 'login' option/button.

  • @bugbytes3923

    @bugbytes3923

    Жыл бұрын

    Hey, thank you for watching. I'll try and get the code online today - will drop a message in here when it's available.

  • @rorisangsitoboli4601

    @rorisangsitoboli4601

    Жыл бұрын

    @@bugbytes3923 Thanks. Will be grateful for that. I really need to master this concept for a project.

  • @rorisangsitoboli4601

    @rorisangsitoboli4601

    Жыл бұрын

    @@bugbytes3923 Good day. Any progress?

  • @bugbytes3923

    @bugbytes3923

    Жыл бұрын

    @@rorisangsitoboli4601 Sorry for the delay. You can find the code here: github.com/bugbytes-io/azure-ad-django-demo

  • @rorisangsitoboli4601

    @rorisangsitoboli4601

    Жыл бұрын

    @@bugbytes3923 Good day. Apology unnecessary. I appreciate your kindness in sharing this valuable information. Thank you much.

  • @user-pr6fe1xy5k
    @user-pr6fe1xy5k7 ай бұрын

    This video is great! Could you help me out on how to extract user PROFILE PICTURE from azure ad? The following code doesn't help me extract user profile picture: request.identity_context_data._id_token_claims It's URGENT, PLEASE help if any of you can... Thanks in advance!