add ModelBackend inheritence to custom auth backend doc to enable Permissions

[mbg]

On ​http://docs.djangoproject.com/en/dev/topics/auth/#writing-an-authentication-backend please consider adding some text describing how and when one might want to inherit ModelBackend in a custom authorization backend. Without ModelBackend the User Permissions are not set as expected from configuration seen in .../admin/auth/user/, e.g. get_all_permissions() returns [] unless ModelBackend is inherited or the code rolls its own Permissions.

Perhaps adding text along with an example something like the following would help:

class MyBackend(django.contrib.auth.backends.ModelBackend):
...

[Karen Tracey]

Reverting anonymous close as fixed since I don't see any evidence this has been addressed.

[Ramiro Morales]

Replying to mbg:

On ​http://docs.djangoproject.com/en/dev/topics/auth/#writing-an-authentication-backend please consider adding some text describing how and when one might want to inherit ModelBackend in a custom authorization backend. Without ModelBackend the User Permissions are not set as expected from configuration seen in .../admin/auth/user/, e.g. get_all_permissions() returns [] unless ModelBackend is inherited or the code rolls its own Permissions.

I think that is precisely what the 'Handling authorization in custom backend' section in that document says: The custom backend needs to implement its own custom authorization policies by implementing the get_group_permissions(), get_all_permissions(), has_perm() and has_module_perms() methods.

(Granted, unfortunately there is a nomenclature gray area here because what Django calls authentication backends [both built-in and external] handle in reality both authentication and authorization.)

IIRC one of the design guidelines followed when creating this pluggable backends machinery was to allow the use of classical Python techniques like duck typing instead of inheritance and this is the idea is conveyed by the text of the document. Adding an example using inheritance wouldn't be consistent with this philosophy.

Leaving ticket open open but moving to DDN.

[Gabriel Hurley]

Amusingly, I agree with both Ramiro and with the reporter (mbg). The current docs cover the intended usage and duck-typing strategy very well, as they should.

However, I don't think it serves the greater good to simply omit ModelBackend from that section of the docs. Adding a few sentences describing how Django uses ModelBackend should be enough to point people in the right direction should they want to go that route without explicitly recommending it.

[Ramiro Morales]

#13466 was closed as a duplicate of this one. It asked for clarification in the docs about the fact writing and using a custom auth backend will mean it needs to perform permission checking itself.

[Aymeric Augustin]

Change UI/UX from NULL to False.

[Aymeric Augustin]

Change Easy pickings from NULL to False.

[Preston Holmes]

closed by:

​https://github.com/django/django/commit/865ff32b84316a416661abc3e3e15c753395486c#L0R1883