Signing out a user without disassociation

[agnt...@gmail.com]

Hello social auth peeps,

I'm having some problems trying to figure out how to get "sign out" to work correctly with python-social-auth and django.  My main objective is to just have the user have to retype in their credentials after they click "sign out".  I don't want to disassociate the user or even necessarily revoke their access tokens.

Is there an easy way to do this?

Thanks!

--Patrick.

[Matías Aguirre]

Hi Patrick,

What you are asking for is the usual "logout" mechanism, just use the logout
method provider by the framework you use, if using Django, use
django.contrib.auth.views.logout, add an URL and a link to that view.

Check the example app,
View: https://github.com/omab/python-social-auth/blob/master/examples/django_example/example/app/views.py#L17-L20
URL: https://github.com/omab/python-social-auth/blob/master/examples/django_example/example/urls.py#L12
Link: https://github.com/omab/python-social-auth/blob/master/examples/django_example/example/templates/home.html#L80-L83

Matías

Excerpts from agntdrake's message of 2014-08-11 21:36:22 -0300:

--
Matías Aguirre (matias...@gmail.com)

[agnt...@gmail.com]

Hi Matías,

Is there something else I need to do other than call Django's logout function?  I'm finding that the user gets logged out, however when they sign-in again, at least with Twitter, they are whisked through Twitter's sign-in screen and aren't prompted for a password or have the chance to change user accounts.

Thanks for the help,

--Patrick.

[Matías Aguirre]

Hi Patrick,

I'm not 100% sure what you are asking this time, if the user is signed out of
Twitter, then it's OK that Twitter ask them to signin again.

What do you mean with "have the chance to change user accounts"?

Matías

Excerpts from agntdrake's message of 2014-08-12 18:58:45 -0300:

> > Matías Aguirre (matias...@gmail.com <javascript:>)
> >

--
Matías Aguirre (matias...@gmail.com)

[agnt...@gmail.com]

Hi Matías,

I'm actually trying to ask the same question as my first post.  Let's say Alice signs in with her Twitter account and she's a new user.  She gets taken to the Twitter sign-in screen where she can enter in her username and password.  She clicks OK, and then gets whisked away to the site where a new account is set up for her.

She uses the site, and then clicks on the "Sign Out" button which logs her out of the Django application (using django.contrib.auth.logout(request)).  If she then clicks "Sign in with Twitter" from the root page a second time, she will be redirected to Twitter for a brief moment and then will be signed back in to the site without ever having had a chance to type in her password.  If Bob was using Alice's machine and he instead wanted to sign in to the site, he would never have had a chance to do that because the sign-in happened automatically.

Is this a misconfiguration on my part?  I would expect that when I call "logout" in Django it would not only log a user out of the system (which it does), but also require returning users to have to re-type in their credentials.

Thanks!

--Patrick.

[Matías Aguirre]

You can't do a logout on a third-party site because you don't have control on
their cookies. You can tell twitter to always force a sign-in dialog on their
end with this setting:

SOCIAL_AUTH_TWITTER_AUTH_EXTRA_ARGUMENTS = {'force_login': 1}

Hope this helps,
Matías

Excerpts from agntdrake's message of 2014-08-13 01:56:00 -0300:

[Patrick Devine]

Hi Matías,

This worked like a charm.  Thank you so much!

I also figured out:

SOCIAL_AUTH_FACEBOOK_AUTH_EXTRA_ARGUMENTS = {'auth_type': 'reauthenticate'}

and:

SOCIAL_AUTH_GOOGLE_OAUTH2_AUTH_EXTRA_ARGUMENTS = {'prompt': 'select_account'}

I can't however find an equivalent function for LinkedIn.  It looks like their API doesn't have any kind of equivalent argument which seems silly.

Also, this seems like it would be really great material for the documentation.  Since every service seems to do things differently from each other, it was hard to even describe the functionality I was expecting.

Thank you again!

--Patrick.

[Michael Gonen]

Hi Patrick and Matias,

I am working on an app, and have the exact same problem you were describing, i.e. I wanted to show the login dialog again to change the user in Facebook. 

Is this solutions still working for you? Because when I use SOCIAL_AUTH_FACEBOOK_AUTH_EXTRA_ARGUMENTS = {'auth_type': 'reauthenticate'}, it gives me a login dialog in which the user cannot be changed, and the password field is empty. 

I would like it to show me a login dialog where my information is already entered (username and password) and only have to click 'OK' to enter, but that gives me the option to change the username and password.

Hope I explained myself well, 

regards,

Michael

Op woensdag 13 augustus 2014 19:32:02 UTC+3 schreef Patrick Devine: