[Python] Using django-okta-auth library: Problem Circular Login while running in LocalHost

I have been using the Okta platform and Django to develop a web application, and I am facing a situation in my localhost that I can't seem to circumvent. I sign into the Okta Sign-In Widget, it brings me to the Okta Verify and then redirects back to Okta Sign-In Widget in a circular pattern. I have the setup as follows for my settings.py:


INSTALLED_APPS = [
'appname',
'okta_oauth2.apps.OktaOauth2Config',
'rest_framework',
'django.contrib.admin',
'django.contrib.auth',
'django.contrib.contenttypes',
'django.contrib.sessions',
'django.contrib.messages',
'django.contrib.staticfiles',
]

MIDDLEWARE = [
'django.middleware.security.SecurityMiddleware',
'django.contrib.sessions.middleware.SessionMiddleware',
'django.middleware.common.CommonMiddleware',
'django.middleware.csrf.CsrfViewMiddleware',
'django.contrib.auth.middleware.AuthenticationMiddleware',
'django.contrib.messages.middleware.MessageMiddleware',
'django.middleware.clickjacking.XFrameOptionsMiddleware',
'okta_oauth2.middleware.OktaMiddleware'
]

AUTHENTICATION_BACKENDS = [
"okta_oauth2.backend.OktaBackend",
]

OKTA_AUTH = {
"ORG_URL": "dev.okta.com",
"ISSUER": "https://dev.okta.com/oauth2/default",
"CLIENT_ID": os.getenv("client_id"),
"CLIENT_SECRET": os.getenv("client_secret"),
"SCOPES": "openid profile email offline_access", # this is the default and can be omitted
"REDIRECT_URI": "http://localhost:8000/accounts/oauth2/callback",
"LOGIN_REDIRECT_URL": "http://localhost:8000/redirect-user/", # default
"CACHE_PREFIX": "okta", # default
"CACHE_ALIAS": "default", # default
"PUBLIC_NAMED_URLS": (), # default
"PUBLIC_URLS": (), # default
"USE_USERNAME": False, # default
}




I have the redirect_URI defined in my Okta dev box, and the login_redirect_url as well. This is my apps urls.py:

urlpatterns = [
path('admin/', admin.site.urls),
path('accounts/', include(("okta_oauth2.urls", "okta_oauth2"), namespace="okta_oauth2")),
path('accounts/login/', okta_views.login, name='login'),
path('accounts/oauth2/callback', views.custom_callback, name='callback'),
path('redirect-user/', view=views.login_redirect_view),
path('appname/Admin/', include("admin.urls")),
]


I have the following views.py:

import logging
logger = logging.getLogger("okta")
def custom_callback(request):
logger.info("==> Entered custom_callback view")

try:
code = request.GET.get("code")
state = request.GET.get("state")
logger.debug(f"Received code: {code}, state: {state}")

if not code or not state:
logger.warning("Missing 'code' or 'state' in GET params")
return HttpResponse("Missing 'code' or 'state' from Okta", status=400)

except KeyError as e:
logger.error(f"KeyError while accessing code/state: {e}", exc_info=True)
return HttpResponse("Missing 'code' or 'state' from Okta", status=400)

try:
from okta_oauth2.backend import OktaBackend
backend = OktaBackend()
logger.debug("Successfully imported OktaBackend")

except ImportError as e:
logger.error("Failed to import OktaBackend", exc_info=True)
return HttpResponse("OktaBackend not able to be imported", status=500)

try:
user = backend.authenticate(request, code=code, state=state)
user.backend = 'okta_oauth2.backend.OktaBackend' # or whatever your full backend path is
logger.debug("Manually set user.backend to OktaBackend")
logger.info(f"Authentication result: {user}")
except Exception as e:
logger.error("Exception during Okta authentication", exc_info=True)
return HttpResponse(f"Authentication failed: {str(e)}", status=401)

if user:
try:
login(request, user)
logger.info(f"User {user} logged in successfully")
logger.debug(f"Session key after login: {request.session.session_key}")
logger.debug(f"User is authenticated: {request.user.is_authenticated}")
em = OKTA_AUTH.get("LOGIN_REDIRECT_URL", '/')
logger.debug(f"Redirecting to: {em}")
return redirect(em)
except Exception as e:
logger.error(f"Exception during login/redirect: {e}", exc_info=True)
return HttpResponse("Login or redirect failed", status=500)

logger.warning("Authentication returned no user")
return HttpResponse("Authentication failed", status=401)


def get_okta_user_profile(user):
logger.info(f"==> Fetching Okta profile for user: {user}")
okta_user_id = user.username
okta_api_token = os.getenv("API_Token")

url = f'https://dev.okta.com/api/v1/users/{okta_user_id}'
headers = {
'Authorization': f'SSWS {okta_api_token}',
'Accept': 'application/json'
}

try:
response = requests.get(url, headers=headers)
logger.debug(f"Okta API response status: {response.status_code}")

if response.status_code == 200:
profile = response.json()['profile']
logger.info(f"Retrieved profile for user {okta_user_id}: {profile}")
return profile
else:
logger.warning(f"Failed to retrieve profile for {okta_user_id}. Status: {response.status_code}")
return {}

except Exception as e:
logger.error("Error fetching Okta profile", exc_info=True)
return {}


def login_redirect_view(request):
logger.info("==> Entered login_redirect_view")

user = request.user
logger.info(f"Authenticated user: {user}")

try:
profile = get_okta_user_profile(user)
role = profile.get("role", "User")
logger.debug(f"User role: {role}")
except Exception as e:
logger.error("Failed to retrieve user role", exc_info=True)
return JsonResponse({'error': 'Could not retrieve user role'}, status=500)

if role == 'Admin':
logger.info(f"Redirecting Admin user {user.username} to admin_home")
return redirect('admin_home')
else:
logger.info(f"User {user.username} redirected to JSON welcome message")
return JsonResponse({'message': f'Welcome {user.username} to the {role} Platform!'})


Before I implemented the Okta platform, my authentication system was working using a SQLite DB, and ModelBackend. I would like to know how I could solve the circular redirection of the login because in the terminal when I am troubleshooting my application I see the following it posts to the callback then it posts back to accounts/login.

Continue reading...