Added JWT authentication, initial roles and permissions

[jimabramson]

@clintonb @rlucioni Please review.
@ormsbee @nasthagiri FYI.

This adds JWT authentication (and only JWT authentication) for the REST API. A little redirection trick when using the oidc login via browser makes the browseable API usable enough (though it doesn't handle refreshing expired tokens).

I have decided to leave the user model in place, even though it is theoretically not needed. The basic reasoning is that it helps to use django's APIs for groups and permissions, and perhaps more significantly, doesn't require a major overhaul of the social-auth pipeline / oidc client, which is a piece I've found rather difficult to debug.

At present one can only login to the API if a properly configured LMS is running to provision the id_tokens. In a separate PR we can modify auto-auth to generate self-issued tokens with long expirations which should make various kinds of manual/automated testing easier.

[rlucioni]

Use .get() here to avoid KeyErrors. If the key is missing, raise DRF's AuthenticationFailed exception.

[jimabramson]

@rlucioni thanks for feedback - addressed your comments in a fixup.

[rlucioni]

👍

[clintonb]

Make these the default authentication class and permissions in settings.

http://www.django-rest-framework.org/api-guide/settings/

[jimabramson]

good idea, done

[clintonb]

Why not use session authentication for the browseable API?

[jimabramson]

@clintonb main reason to disable session auth is to avoid the need for CSRF protection.

[jimabramson]

@clintonb updated with minor improvements to authentication settings.

[clintonb]

@jimabramson what's the harm in CSRF? What, if anything, do we gain from trying to work around de-facto standard behavior?

[jimabramson]

@clintonb do you have a suggestion for how to pass / use csrf tokens when the client is using JWT authentication?

[clintonb]

Session authentication is only used for the browseable API, and all of
those pages already know how to handle CSRF tokens. You can continue using
JWT authentication for all other requests.

Clinton Blackburn

[jimabramson]

@clintonb last fixup adds session authentication and removes the query string / redirection hackery. i've verified that requests using session auth require a csrf token, but jwt auth requests do not. hooray, less code. thanks for the help!

[clintonb]

Move both of the authentication and permission declarations to the defaults in settings. The (very few?) classes that need to override them can, but I'd imagine almost all of the endpoints will use the same authentication and permissions.

[clintonb]

There is an easier way to create custom permissions: https://courses.stage.edx.org/api/credit/v1/courses/.

Also, the add permission should have been created when the model was created, along with the change and delete permissions.

[jimabramson]

@clintonb i added a comment in the last commit explaining why the permission is being created explicitly during the migration.

[jimabramson]

@clintonb cleaned up.

[clintonb]

👍