Fedora Django Authentication Backend

Authors:Ignacio Vazquez-Abrams Date:23 Feb 2009 For Version:0.3.x

The django.auth package provides an authentication backend for Django projects.

Note

Django authentication does not provide single sign-on with other Fedora web apps. it also does not provide CSRF protection. Look at the way that Dango’s builtin forms implement CSRF protection for guidance on how to protect against this sort of attack.

fedora.django.auth

As FAS users are authenticated they are added to FasUser. FAS groups are added to Group both during syncdb and when a user is authenticated.

Integrating into a Django Project

Add the following lines to the project’s settings.py:

AUTHENTICATION_BACKENDS = (
    'fedora.django.auth.backends.FasBackend',
)

FAS_USERNAME = '<username>'
FAS_PASSWORD = '<password>'
FAS_USERAGENT = '<user agent>'
FAS_URL = '<base URL of FAS server>'
FAS_ADMINS = ( ... )

FAS_USERNAME and FAS_PASSWORD are used to retrieve group information during syncdb as well as to retrieve users via the authentication backend. They should be set to a low-privilege account that can read group and user information.

FAS_USERAGENT is the string used to identify yourself to the FAS server.

FAS_URL is the base URL of the FAS server to authenticate against.

FAS_ADMINS is a tuple of usernames that you want to have superuser rights in the Django project.

Add fedora.django.auth.middleware.FasMiddleware to the MIDDLEWARE_CLASSES tuple, between django.contrib.sessions.middleware.SessionMiddleware and django.contrib.auth.middleware.AuthenticationMiddleware.

Additionally, set FAS_GENERICEMAIL to False in order to use the email address specified in FAS instead of <username>``@fedoraproject.org``.

Add fedora.django.auth to INSTALLED_APPS.

Finally, run python manage.py syncdb to add the models for the added app to the database.

Warning

The User.first_name and User.last_name attributes are always empty since FAS does not have any equivalents. The name read-only property results in a round trip to the FAS server.