AuthenticationForm should optionally permit inactive user login

[krejcik@…]

ModelBackend now allows login with inactive user (it has supports_inactive_user property).
But AuthenticationForm never allows login of such user.
I guess it should be configurable because it is designed as base form for all authetication forms.

[hjeffrey]

I don't know it this is the best way of handling the problem, but it seemed the simplest and most straight forward solution that would work generically.

There is possibly the issue that could arise were there are several backends for which the user has inactive accounts, some of which allow inactive users to log in while others do not. In this scenario the user would be rejected if the first backend that had credentials for him didn't allow inactive users to log in ever if others in the list did or even if he had an active account further down the list of backends.

Is inactive user login going to be a project wide setting for all backends or be handled on a backend by backend basis? If it's project wide the approach should work alright, but it still ignore active accounts further down in the list. If it's backend by backend what would be the appropriate authentication handling under the scenario presented?

[Harro]

#12103 is also about inactive users login

[Aymeric Augustin]

We must consider:

• backwards compatibility: suddenly allowing inactive users to log in is absolutely unsafe;
• the ​docs for User.is_active: indeed, it doesn't preclude login of inactive users;
• the ​release notes and ​docs for supports_inactive_user: they say that supports_inactive_user is primarily related to permissions.

Currently, the best solution is to subclass AuthenticationForm and override clean entirely. I'm attaching a patch that makes it easier to support inactive users in a subclass. This would need a little bit more investigation (where is AuthenticationForm used? what do the docs say?), possibly a more complete patch, then tests and docs.

[Claude Paroz]

For me, #12103 is actually a duplicate with a much more elaborate patch (including tests and docs).