add ECD BPN auth

Author: HeinrichAD

fl_server/settings/development.py

@@ -57,3 +57,8 @@
 
 CSRF_COOKIE_SECURE = False
 SESSION_COOKIE_SECURE = True
+
+
+# Eclipse Dataspace Components (EDC) Settings
+
+EDC_API_KEY = "hanspetermayer"

fl_server/settings/production.py

@@ -99,3 +99,8 @@ def get_secret(env_key: str, *, ensure: bool = False) -> str | None:
 
 # Error reporting
 # https://docs.djangoproject.com/en/4.1/howto/deployment/checklist/#error-reporting
+
+
+# Eclipse Dataspace Components (EDC) Settings
+
+EDC_API_KEY = get_secret("FL_EDC_API_KEY")

fl_server_api/openapi.py

@@ -4,6 +4,7 @@
 from docstring_parser import Docstring, parse, RenderingStyle
 from docstring_parser.google import compose
 from drf_spectacular.authentication import BasicScheme
+from drf_spectacular.extensions import OpenApiAuthenticationExtension
 from drf_spectacular.openapi import AutoSchema
 from drf_spectacular.utils import OpenApiExample, OpenApiResponse
 from inspect import cleandoc
@@ -19,9 +20,23 @@ class BasicAuthAllowingTokenAuthInUrlScheme(BasicScheme):
     """
 
     target_class = "fl_server_api.views.base.BasicAuthAllowingTokenAuthInUrl"
+    name = 'basicTokenAuth'
     priority = 0
 
 
+class EDCAuthenticationScheme(OpenApiAuthenticationExtension):
+    """
+    A class that enables EDC BPN authentication.
+    """
+
+    target_class = "fl_server_api.views.base.EDCAuthentication"
+    name = 'edcAuth'
+    priority = 0
+
+    def get_security_definition(self, auto_schema):
+        return {}
+
+
 def create_error_response(
     response_description: Optional[str],
     example_name: str,

fl_server_api/serializers/user.py

@@ -1,10 +1,12 @@
 # SPDX-FileCopyrightText: 2026 German Aerospace Center (DLR)
 # SPDX-License-Identifier: Apache-2.0
 
+from django.http import HttpRequest
 from rest_framework import serializers
 from rest_framework.authtoken.models import Token
 
 from fl_server_core.models import User
+from fl_server_core.models.user import create_edc_bpn
 
 
 class UserSerializer(serializers.ModelSerializer):
@@ -68,19 +70,22 @@ def to_representation(self, instance):
             del data["token"]
         return data
 
-    def create(self, validated_data):
+    def create(self, validated_data, edc_bpn: str | HttpRequest | None) -> User:
         """
         Create a new User instance.
 
         The user's password is set using the `set_password` method.
 
         Args:
             validated_data (dict): The validated data for the new User instance.
+            edc_bpn (str | None): The users EDC BPN.
 
         Returns:
             User: The created User instance.
         """
         user = User.objects.create(**validated_data)
         user.set_password(validated_data["password"])
         user.save()
+        if edc_bpn:
+            create_edc_bpn(user, edc_bpn)
         return user

fl_server_api/tests/test_user.py

@@ -2,11 +2,13 @@
 # SPDX-License-Identifier: Apache-2.0
 
 import base64
+from django.conf import settings
 from django.test import TestCase
 from rest_framework.authtoken.models import Token
 from typing import Any, Dict, Optional, Union
 from uuid import uuid4
 
+from fl_server_core.models.user import create_edc_bpn
 from fl_server_core.tests import BASE_URL, Dummy
 from fl_server_core.models import User
 
@@ -146,3 +148,54 @@ def test_get_user_trainings(self):
             sorted([str(training.id) for training in trainings]),
             sorted([training["id"] for training in response_json])
         )
+
+    def test_get_user_via_edc_bpn(self):
+        user = Dummy.create_user()
+        edc = create_edc_bpn(user, "BPNLC03955YVFP6B")
+        self.client.defaults["X-Api-Key"] = settings.EDC_API_KEY
+        self.client.defaults["Edc-Bpn"] = edc.bpn
+        self.client.defaults["Edc-Contract-Agreement-Id"] = uuid4()
+        response = self.client.get(f"{BASE_URL}/users/")
+        self.assertEqual(200, response.status_code)
+        self.assertEqual("application/json", response["content-type"])
+        response_json = response.json()
+        self.assertEqual(1, len(response_json))
+        self.assertUserEqual(user, response_json[0])
+
+    def test_get_user_via_edc_bpn_without_contract_agreement_id(self):
+        user = Dummy.create_user()
+        edc = create_edc_bpn(user, "BPNLC03955YVFP6B")
+        self.client.defaults["X-Api-Key"] = settings.EDC_API_KEY
+        self.client.defaults["Edc-Bpn"] = edc.bpn
+        with self.assertLogs("django.request", level="WARNING") as cm:
+            response = self.client.get(f"{BASE_URL}/users/")
+        self.assertEqual(cm.output, [
+            "WARNING:django.request:Unauthorized: /api/users/",
+        ])
+        self.assertEqual(401, response.status_code)
+
+    def test_get_user_via_edc_bpn_with_incorrect_x_api_key(self):
+        user = Dummy.create_user()
+        edc = create_edc_bpn(user, "BPNLC03955YVFP6B")
+        self.client.defaults["X-Api-Key"] = "wrong-api-key"
+        self.client.defaults["Edc-Bpn"] = edc.bpn
+        self.client.defaults["Edc-Contract-Agreement-Id"] = uuid4()
+        with self.assertLogs("django.request", level="WARNING") as cm:
+            response = self.client.get(f"{BASE_URL}/users/")
+        self.assertEqual(cm.output, [
+            "WARNING:django.request:Unauthorized: /api/users/",
+        ])
+        self.assertEqual(401, response.status_code)
+
+    def test_get_user_via_edc_bpn_with_none_exiting_bpn(self):
+        user = Dummy.create_user()
+        create_edc_bpn(user, "BPNLC03955YVFP6B")
+        self.client.defaults["X-Api-Key"] = settings.EDC_API_KEY
+        self.client.defaults["Edc-Bpn"] = "none existing BPN"
+        self.client.defaults["Edc-Contract-Agreement-Id"] = uuid4()
+        with self.assertLogs("django.request", level="WARNING") as cm:
+            response = self.client.get(f"{BASE_URL}/users/")
+        self.assertEqual(cm.output, [
+            "WARNING:django.request:Unauthorized: /api/users/",
+        ])
+        self.assertEqual(401, response.status_code)

fl_server_api/views/base.py

@@ -1,11 +1,17 @@
 # SPDX-FileCopyrightText: 2026 German Aerospace Center (DLR)
 # SPDX-License-Identifier: Apache-2.0
 
+from django.conf import settings
+from django.core.exceptions import ObjectDoesNotExist
 from logging import getLogger
-from rest_framework.authentication import BasicAuthentication, SessionAuthentication, TokenAuthentication
+from rest_framework.authentication import (
+    BaseAuthentication, BasicAuthentication, SessionAuthentication, TokenAuthentication
+)
 from rest_framework.permissions import IsAuthenticated
 from rest_framework.viewsets import ViewSet as DjangoViewSet
 
+from fl_server_core.models.user import Edc, get_edc_bpn_from_request
+
 
 class BasicAuthAllowingTokenAuthInUrl(BasicAuthentication):
     """
@@ -34,6 +40,30 @@ def authenticate_credentials(self, userid_or_token, password, request=None):
         return super().authenticate_credentials(userid_or_token, password, request)
 
 
+class EDCAuthentication(BaseAuthentication):
+    def authenticate(self, request):
+        # 1. check EDC connector API key from settings
+        api_key = request.META.get("X-Api-Key", "")
+        if api_key != settings.EDC_API_KEY:
+            return None
+        # 2. get EDC user BPN and Contract-Agreement-Id from request header
+        bpn = get_edc_bpn_from_request(request)
+        if not bpn:
+            return None
+        # 3. get user from EDC settings via BPN
+        try:
+            edc = Edc.objects.get(pk=bpn)
+        except ObjectDoesNotExist:
+            return None
+        user = edc.user
+        if not user:
+            return None
+        return (user, None)
+
+    def authenticate_header(self, request):
+        return "EDC"
+
+
 class ViewSet(DjangoViewSet):
     """
     A base ViewSet that includes default authentication and permission classes.
@@ -46,11 +76,12 @@ class ViewSet(DjangoViewSet):
 
     _logger = getLogger("fl.server")
 
-    # Note: BasicAuthentication is sensles here since it will and can't never be called due to
+    # Note: BasicAuthentication is senseless here since it will and can't never be called due to
     #       BasicAuthAllowingTokenAuthInUrl but is required for OpenAPI to work.
     # Also note that the order of BasicAuthAllowingTokenAuthInUrl and BasicAuthentication is important
     # since if BasicAuthentication is first, Django won't ever call BasicAuthAllowingTokenAuthInUrl!
     authentication_classes = [
+        EDCAuthentication,
         TokenAuthentication,
         BasicAuthAllowingTokenAuthInUrl,
         BasicAuthentication,

fl_server_api/views/user.py

@@ -115,7 +115,7 @@ def create_user(self, request: HttpRequest) -> HttpResponse:
         Returns:
             HttpResponse: new created user as json response
         """
-        user = UserSerializer().create(request.data)
+        user = UserSerializer().create(request.data, request)
         serializer = UserSerializer(user, context={"request_user_id": user.id})
         return Response(serializer.data, status=status.HTTP_201_CREATED)
 

fl_server_core/migrations/0009_alter_globalmodel_options_alter_localmodel_options_and_more.py

@@ -0,0 +1,22 @@
+# Generated by Django 6.0.6 on 2026-06-17 13:18
+
+import django.db.models.deletion
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('fl_server_core', '0008_globalmodel_preprocessing'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='Edc',
+            fields=[
+                ('bpn', models.CharField(max_length=20, primary_key=True, serialize=False)),
+                ('user', models.OneToOneField(on_delete=django.db.models.deletion.CASCADE, to=settings.AUTH_USER_MODEL)),
+            ],
+        ),
+    ]

fl_server_core/models/user.py

@@ -3,9 +3,11 @@
 
 from django.conf import settings
 from django.contrib.auth.models import AbstractUser
+from django.db import models
 from django.db.models import BooleanField, URLField, UUIDField
 from django.db.models.signals import post_save
 from django.dispatch import receiver
+from django.http import HttpRequest
 from rest_framework.authtoken.models import Token
 from uuid import UUID, uuid4
 
@@ -38,6 +40,17 @@ class User(AbstractUser, NotificationReceiver):
     """Endpoint to send the message to."""
 
 
+class Edc(models.Model):
+    """
+    EDC related configuration.
+    """
+
+    bpn = models.CharField(max_length=20, primary_key=True)
+    """Business Partner Number (BPN)"""
+    user = models.OneToOneField(settings.AUTH_USER_MODEL, on_delete=models.CASCADE)
+    """User related to the EDC configuration."""
+
+
 @receiver(post_save, sender=settings.AUTH_USER_MODEL)
 def create_auth_token(sender, instance=None, created=False, *args, **kwargs):
     """
@@ -52,3 +65,38 @@ def create_auth_token(sender, instance=None, created=False, *args, **kwargs):
     """
     if created:
         Token.objects.create(user=instance)
+
+
+def create_edc_bpn(user: User, bpn: str | HttpRequest) -> Edc | None:
+    """
+    Save EDC BPN for user.
+
+    Args:
+        user (User): User.
+        bpn (str | HttpRequest): EDC BPN or http request where the EDC BPN is included inside the header.
+
+    Returns:
+        Edc | None: EDC object or None if not successful.
+    """
+    if not isinstance(bpn, str):
+        bpn = get_edc_bpn_from_request(bpn)
+    if bpn is None:
+        return None
+    return Edc.objects.create(user=user, bpn=bpn)
+
+
+def get_edc_bpn_from_request(request: HttpRequest) -> str | None:
+    """
+    Get EDC BPN from http request object (headers).
+
+    Args:
+        request (HttpRequest): http request object.
+
+    Returns:
+        str | None: EDC BPN or None if not found.
+    """
+    bpn = request.META.get("Edc-Bpn", "")
+    contract_agreement_id = request.META.get("Edc-Contract-Agreement-Id", "")
+    if not bpn or not contract_agreement_id:
+        return None
+    return bpn