How to configure & enable OpenID Connect in DJango+Wagtail app? - django

Question

I'm currently using the python-social-auth/social-core lib with a DJango app, which is configured (and working) to authenticate Wagtail CMS users with our (free) Azure Active Directory Tenant.
Our NFRs stipulate that authentication should occur using OpenID Connect and to this end we've installed "social-auth-core" with the "openidconnect" extra like this in requirements.txt:
...
social-auth-core[openidconnect]
social-auth-app-django
...
Again, things seem to work A-OK and users can login, but here's my problem - and I know I'm missing something here:
As far as I know, OpenID Connect is simply a modification/addition to OAuth2.0 that gives OAuth super powers of authentication - not just authorisation - but I don't know if my DJango+Wagtail app is now just automagically configured to "just work" as/with OpenID Connect, or whether there's some additional logic/validation/config/whatever that I need to apply to the app.
I don't see anything relevant in the official python-social-auth docs for Azure AD, and I don't see how/if I need to explicitly enable OpenID within Azure AD itself.
Can anyone help?
Thank you.

Answer 1

I dug into the OpenID Connect docs for Azure AD and two things I identified as being indicators of OpenID:
That state=openid is used in the MS /oauth2/authorize endpoint
That openid responses arrive back with an OpenID "id_token" key
Docs:
https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-protocols-oidc
https://learn.microsoft.com/en-us/azure/active-directory/develop/id-tokens
Authentication Response:
{
"token_type": "Bearer",
"expires_in": "3599",
"ext_expires_in": "3599",
"expires_on": "1603915195",
"access_token": "*****",
"refresh_token": "*****",
"id_token": "*****",
"aud": "*****",
"iss": "https://sts.windows.net/*****-*****-*****-*****-*****/",
"iat": 1603911295,
"nbf": 1603911295,
"exp": 1603915195,
"amr": [
"pwd"
],
"family_name": "Joe",
"given_name": "Blow",
"ipaddr": "***.***.***.***",
"name": "Joe",
"oid": "*****-*****-*****-*****-*****",
"rh": "*****",
"sub": "*****",
"tid": "*****-*****-*****-*****-*****",
"unique_name": "joe#somedomain.onmicrosoft.com",
"upn": "joe#somedomain.onmicrosoft.com",
"uti": "*****",
"ver": "1.0"
}