contrib.auth documentation is misleading re: whether User.is_active matters for login

[Ethan Jucovy]

The documentation at source:/django//trunk/docs/topics/auth.txt says

    .. attribute:: models.User.is_active

        Boolean. Designates whether this user account should be considered
	active. Set this flag to ``False`` instead of deleting accounts.

	This doesn't control whether or not the user can log in. Nothing in the
        authentication path checks the ``is_active`` flag, so if you want to
        reject a login based on ``is_active`` being ``False``, it is up to you
	to check that in your own login view. However, permission checking
        using the methods like :meth:`~models.User.has_perm` does check this
	flag and will always return ``False`` for inactive users.

"This doesn't control whether or not the user can log in."

This is technically true, but misleading, because the default AuthenticationForm in django.contrib.auth *does* reject inactive users. This behavior is undocumented.

[Ethan Jucovy]

I took a stab at a documentation patch. I feel like this could be clearer, but I'm not sure how.

[Tim Graham]

minor edits to existing patch

[Ivan Sagalaev]

I would also ditch "Nothing in the authentication path checks the is_active" because "authentication path" is not a well-defined thing. I think what this line tries to say is that authentication *backends* might not check for is_active. And the user should check it manually.

[Ivan Sagalaev]

Another edit, without vague "authentication path"

[Adrian Holovaty]

(In [12193]) Fixed #12113 -- Clarified is_active documentation. Thanks, ejucovy and isagalaev