client credentials should be optional (fix #759)

client credentials should only be required on token
request

Signed-off-by: Fernando Rocha <fernandogrd@gmail.com>

1 files changed, 18 insertions, 14 deletions

diff --git a/rest_framework/authentication.py b/rest_framework/authentication.py
index 8f4ec536..f4626a2e 100644
--- a/rest_framework/authentication.py
+++ b/rest_framework/authentication.py
@@ -2,14 +2,16 @@
 Provides a set of pluggable authentication policies.
 """
 from __future__ import unicode_literals
+import base64
+from datetime import datetime
+
 from django.contrib.auth import authenticate
 from django.core.exceptions import ImproperlyConfigured
 from rest_framework import exceptions, HTTP_HEADER_ENCODING
 from rest_framework.compat import CsrfViewMiddleware
 from rest_framework.compat import oauth, oauth_provider, oauth_provider_store
-from rest_framework.compat import oauth2_provider, oauth2_provider_forms, oauth2_provider_backends
+from rest_framework.compat import oauth2_provider, oauth2_provider_forms
 from rest_framework.authtoken.models import Token
-import base64
 
 
 def get_authorization_header(request):
@@ -314,22 +316,24 @@ class OAuth2Authentication(BaseAuthentication):
         """
         Authenticate the request, given the access token.
         """
+        client = None
 
         # Authenticate the client
-        oauth2_client_form = oauth2_provider_forms.ClientAuthForm(request.REQUEST)
-        if not oauth2_client_form.is_valid():
-            raise exceptions.AuthenticationFailed('Client could not be validated')
-        client = oauth2_client_form.cleaned_data.get('client')
-
-        # Retrieve the `OAuth2AccessToken` instance from the access_token
-        auth_backend = oauth2_provider_backends.AccessTokenBackend()
-        token = auth_backend.authenticate(access_token, client)
-        if token is None:
-            raise exceptions.AuthenticationFailed('Invalid token')
+        if 'client_id' in request.REQUEST:
+            oauth2_client_form = oauth2_provider_forms.ClientAuthForm(request.REQUEST)
+            if not oauth2_client_form.is_valid():
+                raise exceptions.AuthenticationFailed('Client could not be validated')
+            client = oauth2_client_form.cleaned_data.get('client')
 
-        user = token.user
+        try:
+            token = oauth2_provider.models.AccessToken.objects.select_related('user')
+            if client is not None:
+                token = token.filter(client=client)
+            token = token.get(token=access_token, expires__gt=datetime.now())
+        except oauth2_provider.models.AccessToken.DoesNotExist:
+            raise exceptions.AuthenticationFailed('Invalid token')
 
-        if not user.is_active:
+        if not token.user.is_active:
             msg = 'User inactive or deleted: %s' % user.username
             raise exceptions.AuthenticationFailed(msg)