Django认证()适用于自定义用户模型

Question

以下是我的自定义用户模型：

 class CUserManager(BaseUserManager):

        def _create_user(self, email, first_name, password,
                         is_staff, is_superuser, **extra_fields):
            """
        Creates and saves a User with the given email and password.
        """
        now = timezone.now()
        if not email:
            raise ValueError('The given email must be set')
        email = self.normalize_email(email)
        user = self.model(email=email,
                          first_name = first_name,
                          is_staff=is_staff, is_active=False,
                          is_superuser=is_superuser, last_login=now,
                          date_joined=now, **extra_fields)
        user.set_password(password)
        user.save(using=self._db)
        return user

    def create_user(self, email, first_name, password=None, **extra_fields):
        return self._create_user(email, first_name, password, False, False,
                                 **extra_fields)

    def create_superuser(self, email, first_name, password, **extra_fields):
        return self._create_user(email, first_name, password, True, True,
                                 **extra_fields)


class CUser(AbstractBaseUser, PermissionsMixin):
    email = models.EmailField(_('email address'), max_length=254, unique=True)
    first_name = models.CharField(_('first name'), max_length=30)
    last_name = models.CharField(_('last name'), max_length=30, blank=True)
    is_staff = models.BooleanField(_('staff status'), default=False,
        help_text=_('Designates whether the user can log into this admin '
                    'site.'))
    is_active = models.BooleanField(_('active'), default=False,
        help_text=_('Designates whether this user should be treated as '
                    'active. Unselect this instead of deleting accounts.'))
    date_joined = models.DateTimeField(_('date joined'), default=timezone.now)
    last_updated = models.DateTimeField(_('last updated'), default=timezone.now)

    objects = CUserManager()

    USERNAME_FIELD = 'email'
    REQUIRED_FIELDS = ['first_name', 'last_name']

它可以正确地创建新用户。但是当我尝试从shell或视图进行用户身份验证时，authenticate()函数对于具有is_active=False的用户无法工作。

>>> from django.contrib.auth import get_user_model, auhtenticate
>>> u = get_user_model()
>>> authenticate(username='[e-mail]', password='abc)

上述代码行如果用户处于非活跃状态则返回空，否则返回用户对象。我不明白为什么对于非活跃用户会返回空。

- toothie

---

将用户标记为不活跃，就是为了达到这个目的。如果你的账户不活跃，就无法登录。 - Daniel Roseman

Answer 1

这是因为 Django 的身份验证机制导致的。 默认情况下 它使用 ModelBackend 来检查 is_active https://docs.djangoproject.com/en/1.10/ref/contrib/auth/#django.contrib.auth.backends.ModelBackend.get_user_permissions。

所以你可以创建自定义身份验证后端来忽略这个选项 https://docs.djangoproject.com/en/1.10/topics/auth/customizing/#writing-an-authentication-backend。

- Sardorbek Imomaliev

Answer 2

你好，你可以为这个问题编写自定义后端。

from django.contrib.auth.hashers import check_password 

from django.contrib.auth.models import User

from apps.staffs.models import Staff(Custom User)


class StaffBackend:

    # Create an authentication method
    # This is called by the standard Django login procedure
    def authenticate(self, username=None, password=None):

        try:
            # Try to find a user matching your username
            user = Staff.objects.get(username=username)

            #  Check the password is the reverse of the username
            if check_password(password, user.password):
                # Yes? return the Django user object
                return user
            else:
                # No? return None - triggers default login failed
                return None
        except Staff.DoesNotExist:
            # No user was found, return None - triggers default login failed
            return None

    # Required for your backend to work properly - unchanged in most scenarios
    def get_user(self, user_id):
        try:
            return Staff.objects.get(pk=user_id)
        except Staff.DoesNotExist:
            return None

- user5662309

Answer 3

有标准的方法可以通过自定义身份验证后端来实现。其中一些对于需要在最后期限内完成的简单应用程序来说可能会感到太繁琐。这是一个定制的函数，可以解决这个问题：

代码

from django.contrib.auth.hashers import check_password

from users.models import CustomUser


def authenticate(username=None, password=None):
    try:
        # Get the corresponding user.
        user = CustomUser.objects.get(username=username)
        #  If password, matches just return the user. Otherwise, return None.
        if check_password(password, user.password):
            return user
        return None
    except CustomUser.DoesNotExist:
        # No user was found.
        return None

解释

• 如果找到与给定的用户名和密码相匹配的用户，则返回一个用户对象。
• username 参数也可以替换为任何其他参数，例如 email 等，具体取决于逻辑需要。
• 在此不需要自定义模型Manager。

何时以及如何使用？

我在每个应用程序中都有一个特殊的 helper.py 文件来存放这样的函数或类。所以这就是它所属的地方。只需导入它并按照通常的方式使用 authenticate()，除了现在它将在CustomUser 模型上工作而不是 User 模型上。

- Bruce Wayne