Ticket #689: remote_user_2.diff

django/contrib/auth/backends.py

@@ -19 +19 @@
             return User.objects.get(pk=user_id)
         except User.DoesNotExist:
             return None
+
+class RemoteUserAuthBackend(ModelBackend):
+    def authenticate(self, username, password=None):
+        """
+        Authenticate user - RemoteUserAuth middleware passes REMOTE_USER
+        as username. password param is not used, just added in case :)
+        """
+        user = None
+        if username:
+            try:
+                user = User.objects.get(username=username)
+            except User.DoesNotExist:
+                user = self.unknown_user(username)
+        return user
+
+    def unknown_user(username):
+        # Auto-create user
+        password = User.objects.make_random_password()
+        user = User.objects.create_user(username, '', password)
+        user.is_staff = False
+        user.save()
+        user = self.configure_user(user)
+        return user
+
+    def configure_user(user):
+        # Override this to set custom properties for a new user
+        return user
+

django/contrib/auth/middleware.py

@@ -10 +10 @@
         assert hasattr(request, 'session'), "The Django authentication middleware requires session middleware to be installed. Edit your MIDDLEWARE_CLASSES setting to insert 'django.contrib.sessions.middleware.SessionMiddleware'."
         request.__class__.user = LazyUser()
         return None
+
+class RemoteUserAuthMiddleware(object):
+    def process_request(self, request):
+        from django.contrib.auth import authenticate, login
+        # AuthenticationMiddleware is required to create request.user
+        error = """The Django RemoteUserAuth middleware requires authentication middleware to be installed. Edit your MIDDLEWARE_CLASSES
+setting to insert 'django.contrib.auth.middleware.AuthenticationMiddleware' *before* the RemoteUserMiddleware class."""
+        assert hasattr(request, 'user'), error
+        if request.user.is_anonymous():
+            try:
+                user = authenticate(username=request.META['REMOTE_USER'])
+            except:
+                user = None
+            if user is not None:
+                request.user = user    # set request.user to the authenticated user
+                login(request, user)   # auto-login the user to Django
+        return None

docs/auth_remote_user.txt

@@ +1 @@
+=============================
+Authenticating against REMOTE_USER from Apache
+=============================
+
+Typically on an intranet, users are already authenticated (e.g. in a Windows domain).
+It is possible to let Apache use NTLM to verify that a user is authenticated, and only 
+allow valid users to enter your website. Apache will set a REMOTE_USER variable containing
+the user's username. This can be used to inform django which user is accessing the site.
+If the user is not yet in Django's userbase, she can be added automatically.
+
+Configuring Apache
+==============
+
+You will need a module that can authenticate using NTLM.
+Examples are mod_NTLM or mod_auth_sspi.
+Configure Apache to use these to authenticate the user.
+An example configuration using mod_auth_sspi looks like this:
+
+# Add the module:
+
+LoadModule sspi_auth_module modules/mod_auth_sspi.so
+
+# Configure the authentication:
+
+    <Location /example/>
+        AuthName "myIntranet"
+        AuthType SSPI
+        SSPIAuth On
+        SSPIAuthoritative On
+        SSPIDomain "myDomain"
+        SSPIOmitDomain On
+        SSPIUsernameCase "upper"
+        
+        Require valid-user
+
+        SetHandler python-program
+        PythonHandler django.core.handlers.modpython
+        SetEnv DJANGO_SETTINGS_MODULE your_settings
+        PythonPath "['d:\\\\websites'] + ['d:\\\\websites\\\\myproject'] + sys.path"
+    </Location>
+
+Configuring Django
+=============
+
+In your settings file, add the RemoteUserAuthMiddleware and the RemoteUserAuthBackend like this:
+
+Add the middleware AFTER the AuthenticationMiddleware:
+
+    'django.contrib.auth.middleware.AuthenticationMiddleware',
+    'django.contrib.auth.middleware.RemoteUserAuthMiddleware',
+    
+Add the RemoteUserAuthBackend as authentication backend:
+    AUTHENTICATION_BACKENDS = (
+        'django.contrib.auth.RemoteUserAuthBackend',
+    )
+
+Subclassing the RemoteUserAuthBackend
+==============================
+
+By default, the RemoteUserAuthBackend will simply add any non existing user to the Django user database.
+Since the user was let in by Apache, it is supposed to be a valid user.
+However, you may override this behaviour by subclassing the RemoteUserAuthBackend:
+
+Override the auto-creation of users
+----------------------------------
+The RemoteUserAuthBackend has a function unknown_user(username), which by default creates a new
+User object for any user not yet known to Django. It returns the new user object.
+If you don't want to auto-create new users, you may override this function to return None. 
+
+Example:
+
+    in settings.py:
+    
+        AUTHENTICATION_BACKENDS = (
+            'myproject.utils.MyOwnRemoteUserAuthBackend',
+        )
+    
+    in myproject.utils:
+    
+        from django.contrib.auth.backends import RemoteUserAuthBackend
+    
+        class MyOwnRemoteUserAuthBackend(RemoteUserAuthBackend):
+            def unknown_user(self, username):
+                return None
+
+
+Configure the properties for the newly created user
+-------------------------------------------------
+The RemoteUserAuthBackend has a function configure_user(user), which by default does nothing to 
+the new user object.
+
+You could however use this function to set detailed info or permissions on the users (e.g. using info
+from an LDAP source).
+
+Example:
+
+    in settings.py:
+    
+        AUTHENTICATION_BACKENDS = (
+            'myproject.utils.MyOwnRemoteUserAuthBackend',
+        )
+    
+    in myproject.utils:
+    
+        from django.contrib.auth.backends import RemoteUserAuthBackend
+    
+        class MyOwnRemoteUserAuthBackend(RemoteUserAuthBackend):
+            def configure_user(self, user):
+                # put your custom code here
+                user.last_name = user.username
+                user.save()
+                #
+                return user