Django authentication not working

Question

I created the authentication.py file at the same level as the settings.py file in my django project. The contents of this file are:

from django.contrib.auth.models import User class SettingsBackend(object): def authenticate(self, request, username=None, password=None): user_name = 'user_name' user_password = 'user_pass' login_valid = (user_name == username) pwd_valid = (password == user_password) if login_valid and pwd_valid: try: user = User.objects.get(username=username) except User.DoesNotExist: user = User(username=username) user.is_staff = True user.is_superuser = True user.save() return user return None def get_user(self, user_id): try: return User.objects.get(pk=user_id) except User.DoesNotExist: return None 

Then I added the following line in the settings.py file:

 AUTHENTICATION_BACKENDS = ('myProject.authentication.SettingsBackend',) 

However, the login does not work. It worked before these changes when user credentials are stored in a database. I do not know how I can debug this. Any idea?

Here are some parts of my settings file:

 INSTALLED_APPS = [ 'django.contrib.auth', 'django.contrib.contenttypes', 'django.contrib.sessions', 'django.contrib.messages', 'django.contrib.staticfiles', 'django.contrib.humanize', 'default', ] MIDDLEWARE = [ 'django.middleware.security.SecurityMiddleware', 'django.contrib.sessions.middleware.SessionMiddleware', 'django.middleware.common.CommonMiddleware', 'django.middleware.csrf.CsrfViewMiddleware', 'django.contrib.auth.middleware.AuthenticationMiddleware', 'django.contrib.messages.middleware.MessageMiddleware', 'django.middleware.clickjacking.XFrameOptionsMiddleware', ] TEMPLATES = [ { 'BACKEND': 'django.template.backends.django.DjangoTemplates', 'DIRS': ["templates/"], 'APP_DIRS': True, 'OPTIONS': { 'context_processors': [ 'django.template.context_processors.debug', 'django.template.context_processors.request', 'django.contrib.auth.context_processors.auth', 'django.contrib.messages.context_processors.messages', ], }, }, ] DATABASES = { 'default': { 'ENGINE': 'django.db.backends.sqlite3', 'NAME': os.path.join(BASE_DIR, 'db.sqlite3'), } } # Password validation # https://docs.djangoproject.com/en/1.10/ref/settings/#auth-password-validators AUTH_PASSWORD_VALIDATORS = [ { 'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator', }, { 'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator', }, { 'NAME': 'django.contrib.auth.password_validation.CommonPasswordValidator', }, { 'NAME': 'django.contrib.auth.password_validation.NumericPasswordValidator', }, ] LOGIN_REDIRECT_URL = '/' LOGIN_URL = '/login' LOGOUT_URL = '/logout' ADMIN_ENABLED = False 

EDIT : I deleted the file “db.sqlite3” in the root of my folder, then launched the django shell and did:

 from django.contrib.sessions.models import Session Session.objects.all().delete() 

Then I get the following:

 from django.contrib.auth.models import User user = User.objects.get(username='user_name') >> DoesNotExist: User matching query does not exist. 

Answer 1

I was surprised that the code did not work and did not examine it.

Please note that there is a difference between django versions:

The query parameter for the custom backend is added in 1.11. If you are using version <1.11, remove the query parameter.

 def authenticate(self, username=None, password=None): 

Django 1.10 backend authentication-entry

Django 1.11 write-a-authentication-backend

I debugged it by examining def authenticate (...) in the django source, it iterates over all the servers.

Answer 2

You can try running:

 Session.objects.all().delete(). 

Before testing the new auth server. From the Django docs:

After user authentication, Django stores which backend was used to authenticate the user in the user session and reuse the same backend for the entire session when access to the authenticated user is required. This actually means that authentication sources are session-based cached, so if you change AUTHENTICATION_BACKENDS, you need to clear the session data if you need to force users to re-authenticate using different methods. An easy way to do this is to simply execute Session.objects.all (). Delete ().