Search code examples
djangoazuredjango-rest-frameworkpostmanadfs

Issue with Django API Authentication Using Azure AD and Postman

I have set up a django project using the django_auth_adfs library to use the Azure Active Directory for the authentication phase. I have set up its API using rest_framework and now, I am trying to send requests to it using Postman. My problem is that if I send a request with or without an access token, my result is nothing but the raw html code of the Microsoft login page. I used this link for generating my access token:

https://dev.to/425show/calling-an-azure-ad-secured-api-with-postman-22co

I tried different API Permissions for my Azure App such as Azure Active Directory Graph, Microsoft Graph, and one under my own project name which comes from the one I configured as a scope in the Expose an API. Also I wonder if the company should grant access to the api I configured in the Expose an API?

This is the Result I get and this is my postman environment. During the token registration, I am prompt to login using my username, password, and the authentication code sent to my phone, and then, the token is generated successfully. However, I am still getting the login page, although I am using the token in my headers. Also about the django ad configuration, it works fine. People can login and logout using their Microsoft accounts, so the problem should not be there.

Solution

  • Steps to authenticating Django API using Azure Active Directory (AD) and accessing it via Postman.

    Create an application in App registrations of Microsoft Entra ID.Choose Supported account types as Microsoft Entra ID tenant - Multitenant and personal Microsoft accounts for api.

    enter image description here

    Add a scope in Expose an API by selecting consent as Admins and users as shown in the below image. enter image description here

    enter image description here

    Use Instance ,ClientId and TenantId in Django API .

     "Instance": "https://login.microsoftonline.com/",
 "ClientId": "18", //Application (Client) ID from 'Catalogue.Api' app registration overview blade
 "TenantId": "932" // Tenant ID from '.Catalogue.Api' app registration overview blade
    • Create a another application in Microsoft Entra ID for postman with below callback url

    https://www.postman.com/oauth2/callback

    enter image description here

    Select Access tokens ,ID tokens in Authentication and save it. enter image description here

    In postman application add API permissions for Api app which you have created.

    enter image description here

    Select Delegated permissions and Permissions of api and add permission. enter image description here

    • Add a client secret in Postman app.

    enter image description here

    • Create a new Environment with unique name and add variables, Initial values and current values as shown in the below images .

    enter image description here enter image description here

    • Replace the values of productAPiURl of Django API ,callbackurl,clientid,tenantld,scope and clientSecret.

    enter image description here

    • Create a new request and select the Auth Type as OAuth 2.0 .

    • Change Callback URL ,Auth URL ,Access Token URL ,Client ID ,Client Secret ,Scope and State with Postman app details

    enter image description here

      Callback URL:  {{callbackUrl}}
  Auth URL:  https://login.microsoftonline.com/{{tenantid}}/oauth2/v2.0/authorize
  Token URL : https://login.microsoftonline.com/{{tenantid}}/oauth2/v2.0/token
  Client ID :  {{clientId}}
  Client Secret :  {{clientSecret}}
  Scope:  {{scope}}
    • Click on Get New Acccess token to sign in and genereate the new token.

    enter image description here

    enter image description here

    • Use the token in headers as key name with Authorization .

    enter image description here

    Replace the Django API Url and send the request.

    enter image description here