Python (Django)

IDRA_ISSUER=https://<your-org>.idra.team/api/auth
IDRA_CLIENT_ID=<Client ID>
IDRA_CLIENT_SECRET=<client secret>
APP_URL=http://localhost:8000
SESSION_SECRET=<output of: openssl rand -hex 32>

python3 -m venv .venv && source .venv/bin/activate
pip install django==6.1.2 authlib==1.9.1 requests==2.34.2
django-admin startproject mysite .

import os

SECRET_KEY = os.environ["SESSION_SECRET"]
SESSION_ENGINE = "django.contrib.sessions.backends.signed_cookies"
SESSION_COOKIE_SECURE = os.environ["APP_URL"].startswith("https://")

import json
import os
from urllib.parse import urlencode

from authlib.integrations.django_client import OAuth
from django.http import HttpResponse
from django.shortcuts import redirect
from django.utils.html import format_html

ISSUER = os.environ["IDRA_ISSUER"]
APP_URL = os.environ["APP_URL"]

oauth = OAuth()
idra = oauth.register(
    "idra",
    client_id=os.environ["IDRA_CLIENT_ID"],
    client_secret=os.environ["IDRA_CLIENT_SECRET"],
    server_metadata_url=f"{ISSUER}/.well-known/openid-configuration",
    client_kwargs={
        "scope": "openid profile email groups",
        "code_challenge_method": "S256",
        "token_endpoint_auth_method": "client_secret_basic",
    },
)


def home(request):
    user = request.session.get("user")
    if not user:
        return HttpResponse('<h1>Signed out</h1><a href="/login">Sign in with IdRa</a>')
    return HttpResponse(
        format_html(
            '<h1>Signed in</h1><pre>{}</pre><a href="/logout">Sign out</a>',
            json.dumps(user, indent=2),
        )
    )


def login(request):
    return idra.authorize_redirect(request, f"{APP_URL}/callback")


def callback(request):
    try:
        token = idra.authorize_access_token(request)
        # The ID token has no email or name: they come from UserInfo.
        request.session["user"] = dict(idra.userinfo(token=token))
        request.session["id_token"] = token["id_token"]
    except Exception as e:
        print(f"Sign-in failed: {e!r}")
        return HttpResponse(format_html("Sign-in failed: {}", e), status=400)
    return redirect("/")


def logout(request):
    id_token = request.session.get("id_token")
    request.session.flush()
    if not id_token:
        return redirect("/")
    metadata = idra.load_server_metadata()
    query = urlencode({"id_token_hint": id_token, "post_logout_redirect_uri": f"{APP_URL}/"})
    return redirect(f"{metadata['end_session_endpoint']}?{query}")

from django.urls import path

from . import views

urlpatterns = [
    path("", views.home),
    path("login", views.login),
    path("callback", views.callback),
    path("logout", views.logout),
]

set -a; source .env; set +a
python manage.py runserver 8000