Require login across entire site
Middleware that locks down an entire site, requiring the user to login to view any page. Great for development/beta-testing.
- middleware
- authentication
- login
- lockdown
- auth
Middleware that locks down an entire site, requiring the user to login to view any page. Great for development/beta-testing.
I put this in a file called auth.py, then referenced it in the settings.py like so: AUTHENTICATION_BACKENDS = ('myproject.myapp.auth.ActiveDirectoryBackend',) This has been tested on my office network, with the following setup: Django 0.96 Python 2.4.4 python-ldap Fedora Core 5 (On the server hosting Django) AD Native Mode 2 Windows 2003 AD servers
A simple login form that does the actual authentification itself. **Usage:** if request.method == "POST": loginform = LoginForm(request.POST) if loginform.login(): return HttpResponseRedirect(redir_url) else: loginform = LoginForm()
Example (in project/application/models.py): register_custom_permissions_simple((("is_editor", "User is editor"),)) In a view: if not request.user.has_perm('application.is_editor'): return HttpResonseRedirect(LoginUrl)
Authentication through Facebook's Graph API. See [http://developers.facebook.com/docs/authentication/](http://developers.facebook.com/docs/authentication/) [http://developers.facebook.com/docs/authentication/permissions](http://developers.facebook.com/docs/authentication/permissions) [http://developers.facebook.com/docs/api](http://developers.facebook.com/docs/api) [http://github.com/facebook/python-sdk/blob/master/examples/oauth/facebookoauth.py](http://github.com/facebook/python-sdk/blob/master/examples/oauth/facebookoauth.py) Define the facebook tokens in settings.py and replace <app_name> with the name of your app. You will probably want to modify the scope on the authorize link in the template, see the authentication permissions link. This updates the user model every time the user logs in but I think that it is okay so the data is always correct. I have tested this but not rigorously. If there is a hole and everyone gets admin rights to your site don't say I didn't warn you :). Comments are appreciated. 16 June 2010 Added missing imports. Cleaned up the template. Shouts out to @obeattie and @whalesalad
Here's a signal handler to log a user in on registration activation. It took me an hour to figure out that I needed to put the user.backend in quotes and google wasn't being my friend. from [the django-registration documentation](http://docs.b-list.org/django-registration/0.8/faq.html): How do I log a user in immediately after registration or activation? You can most likely do this simply by writing a function which listens for the appropriate signal; your function should set the backend attribute of the user to the correct authentication backend, and then call django.contrib.auth.login() to log the user in.
This backend will allow you to have users login using either their username or the email address as it is in the User model. In addition, it will allow anyone with the staff priveleges to login as another user. The method is to user the user you wish to masquerade as (either email/username) as the username and then a string of the format *username*/*password* as the password, where *username* is the username of the staff member, and *password* is their password.
Sometimes the only way to reproduce a bug on a production site is to login as the User who encountered it. This form allows you to login as any user on the site. **Usage** @staff_member_required def login_as(request, template="login_as.html"): data = request.POST or None form = LoginAsForm(data, request=request) if form.is_valid() form.save() return HttpResponseRedirect(settings.LOGIN_REDIRECT_URL) ...
An example of using it in your settings.py: MIDDLEWARE_CLASSES = ( 'django.middleware.common.CommonMiddleware', 'django.contrib.sessions.middleware.SessionMiddleware', 'django.contrib.auth.middleware.AuthenticationMiddleware', 'django.middleware.doc.XViewMiddleware', 'util.loginmiddleware.RequireLoginMiddleware', ) LOGIN_REQUIRED_URLS = ( r'/payment/(.*)$', r'/accounts/home/(.*)$', r'/accounts/edit-account/(.*)$', ) In a nutshell this requires the user to login for any url that matches against whats listing in LOGIN_REQUIRED_URLS. The system will redirect to [LOGIN_URL](http://www.djangoproject.com/documentation/settings/#login-url)
An "if-style" template tag that checks to see if a user belongs to a specific group (by name).
A simple backend which allows you to login with either an email address or a username. It should be combined with another backend for checking permissions: AUTHENTICATION_BACKENDS = ( 'myproject.accounts.backends.EmailOrUsernameModelBackend', 'django.contrib.auth.backends.ModelBackend' )
[Chris' code](http://djangosnippets.org/snippets/1845/) adapted to django 1.3. Basicly E-mail authorisation backend. Put it as one of your AUTHENTICATION_BACKENDS in settings.py: AUTHENTICATION_BACKENDS = ( 'community.auth.EmailBackend', )
By enabling this backend: AUTHENTICATION_BACKENDS = ( 'path.to.my.backends.CaseInsensitiveModelBackend', ) Your users will now be able to log in with their username, no matter whether the letters are upper- or lower-case.
This Middleware is to log users out after a certain amount of time has passed. You'll want to add AUTO_LOGOUT_DELAY to your settings.py, set to a number of minutes after which a user should be logged out. It adds the key 'last_touch' to the session, you'll want to change that if you happen to be using that already.
These decorators are based on user_passes_test and permission_required, but when a user is logged in and fails the test, it will render a 403 error instead of redirecting to login - only anonymous users will be asked to login.