Django authenticating using non django user

Question

I have to write a Django application / website which gets all of it's data from a third party REST server. This means that I'm actually not using any of the default Django ORM models, and reading everything from REST Requests. This seems to be working fine, since I'm able to call some methods on the REST server and get a list of objects, display objects, update, add and delete objects ...

But now I also need users to log in to the Django site / application, since only registered and logged in users should be able to see the data. Of course users are also handled by the third party REST server, and thus are not created by the Django ORM.

The REST API has methods to get / create a user and check if a user / password combination is valid. But I am wondering how I should use that from within my Django application / website.

I guess I won't be able to use something like request.user.is_authenticated since that's something the remote REST API should validate. I have read something about a REMOTE_USER but can't seem to find any good examples on how to set up RemoteUserBackend to suit my needs.

Anyone here who has any suggestions or could point me in the right direction?

yamm yamm · Accepted Answer · 2015-04-01T09:45:42

I would sugest to write your own authentication-backend.

You could take the credentials, authenticate over the REST, get the informations you need to create a django Usermodel Object and return that. This will ofc not be saved or loaded from your own database. Its just a newly created object.

class MyBackend(object):
    def authenticate(self, username=None, password=None, token=None):
        if token:
            # token auth over rest
        elif username and password:
            # normal auth over rest
        else:
            return None

        # read django docs to User model
        from django.contrib.auth.models import User
        myUser = User()
        myUser.username = name_from_rest
        myUser.set_password(pw_from_rest)
        myUser.save()
        return myUser
        ...

I have never done this nor do i know if this will work. But that is how i would try it, if i could not save the user in any DB.

Django authenticating using non django user

1 Answers