In a Django application, I am using the django_auth_adfs module.

In my frontend, I can have users log in as company externals via Microsoft authentication.

Unfortunatelly, they are getting a 401 error when trying to send requests to my Django backend.

In the Django Documentation I found the following

I’m receiving an KeyError: ‘upn’ error when authenticating against
Azure AD.¶ In some circumstances, Azure AD does not send the upn claim
used to determine the username. It’s observed to happen with guest
users who’s source in the users overview of Azure AD is Microsoft
Account instead of Azure Active Directory.

In such cases, try setting the USERNAME_CLAIM to email instead of the
default upn. Or create a new user in your Azure AD directory.

If I switch the USERNAME_CLAIM from upn to email the guest can now receive the HTTP results, but the problem is that the company members now can not.

I then went to my App Registration -> Token configuration -> Access and added upn as an optional token with the option Externally authenticated: This option includes the guest UPN as stored in the resource tenant. set to yes.

Now the guest has in its access token also the optional claim upn. Unfortunatelly, I am now getting the error 500: django.core.exceptions.ValidationError: {'username': ['Enter a valid username. This value may contain only letters, numbers, and @/./+/-/_ characters.']}

The reason is that within the guest’s token the value of the upn contains #EXT#. Any idea how to handle this?

I just want that both internals and registered externals have access to the data. Of course I will later filter the results according to some roles.