Adapter

class allauth.idp.oidc.adapter.DefaultOIDCAdapter(request: HttpRequest | None = None)

The adapter class allows you to override various functionality of the allauth.idp.oidc app. To do so, point settings.IDP_OIDC_ADAPTER to your own class that derives from DefaultOIDCAdapter and override the behavior by altering the implementation of the methods according to your own needs.

generate_client_id() → str

The client ID to use for newly created clients.

generate_client_secret() → str

The client secret to use for newly created clients.

get_claims(purpose: Literal['id_token', 'userinfo'], user: AbstractBaseUser, client: Client, scopes: Iterable[str], email: str | None = None, **kwargs: Any) → dict[str, Any]

Return the claims to be included in the ID token or userinfo response.

get_issuer() → str

Returns the URL of the issuer.

get_jwks_cache_control() → int

Returns the cache control value for the JWKS endpoint. The default implementation returns the value of the IDP_OIDC_JWKS_CACHE_CONTROL setting, clamped so that clients refetch before the next key drops out of the key set (i.e. before the soonest expires_at). Override this method to provide a different cache control value, e.g. in case of a secret manager / vault is used.

get_signing_key() → PrivateKey

Returns the private key used for signing new tokens: the most recently issued key that has activated and not yet expired. Raises ImproperlyConfigured if no such key is found.

get_user_by_sub(client: Client, sub: str) → AbstractBaseUser | None

Looks up a user, given its subject identifier. Returns None if no such user was found.

get_user_sub(client: Client, user: AbstractBaseUser) → str

Returns the “sub” (subject identifier) for the given user.

hash_token(token: str) → str

We don’t store tokens directly, only the hash of the token. This methods generates that hash.

is_cimd_url_allowed(url: str) → bool

Determines whether the given CIMD (Client ID Metadata Document) URL is accepted as a client_id.

Override this method to restrict which clients can authenticate via CIMD, for example by maintaining a domain allowlist. The default implementation accepts all URLs that pass structural validation.

is_introspection_allowed(token: Token, *, caller_client: Client) → bool

This method can be used to add additional checks to determine if a token is valid in introspection responses and if the caller client is allowed to introspect it. The default implementation allows all introspection requests for active tokens, regardless of the caller client.

caller_client: The authenticated introspection caller client.

list_private_keys(*, did_activate: Literal[True] | None = None, is_active: Literal[True] | None = None) → list[PrivateKey]

Returns the configured private keys, optionally filtered. Pass did_activate=True to exclude keys whose not_before lies in the future, and/or is_active=True to exclude keys past their expires_at. Used both for token verification and for serving .well-known/jwks.json.

populate_access_token(access_token: dict[str, Any], *, client: Client, scopes: Iterable[str], user: AbstractBaseUser, **kwargs: Any) → None

This method can be used to alter the JWT access token payload. It is already populated with basic values.

populate_id_token(id_token: dict[str, Any], client: Client, scopes: Iterable[str], **kwargs: Any) → None

This method can be used to alter the ID token payload. It is already populated with basic values. Depending on the client and requested scopes, you can expose additional information here.

populate_introspection_response(*, response: dict[str, Any], token: Token) → None

This method can be used to add additional information to the introspection response for a given token. The default implementation does nothing.

populate_server_metadata(data: dict[str, str | list[str]]) → None

Allows for customizing the /.well-known/openid-configuration payload, as specified in RFC 8414 (OAuth 2.0 Authorization Server Metadata).

validate_client_registration(*, client: Client, client_metadata: dict[str, Any], token: Token | None, bearer_token: str | None, **kwargs: Any) → None

This method is called after all builtin validation was successful, and just before the actual client is being created. To intervene, raise a ValidationError or an ImmediateHttpResponse.

client: The Client instance that is about to be saved. client_metadata: The raw JSON payload from the DCR request. token: The Token instance corresponding to the initial access

token, or None if no token was provided.

bearer_token: The raw bearer token string from the Authorization

header, or None if no token was provided.

validate_resource_uris(*, uris: list[str], **kwargs: Any) → None

Allows for custom validation of resource URIs (RFC 8707). Throw a ValidationError to reject the resource.