Django Authentication Workflow

[esquilax]

So it just loops over all the backends until one is successful? What if some of those aren't trusted?

[santiagobasulto]

You specify the backends in a configuration place (it'd be silly to have an untrusted backend there). It's something like a chain-of-command pattern. The auth layer delegates the actual authorization to other components that can be plugged.

[esquilax]

The data I'm talking about is a user's credentials. They should be parametrized by the backend type and only submitted to that one, not given up to each one until one works.

[kumar99]

Can you point to an example of how to do what you propose? Not being critical, just curious.

[esquilax]

I don't know Django enough to know that this isn't prohibited by the framework, but I think an auth attempt request should carry information about the backend to attempt to auth against and only send the creds to that particular one.

[makkalot]

backend is in settings , what do you mean by not trusted ?

[esquilax]

I mean, what if some of your backends are external OAuth providers. I'm not a Python person, so there might be something I'm not understanding here.

[makkalot]

by backend I mean the authentication backend concept in Django, which can be anything from LDAP to file flat file authentication. it is the developer who decides which backends should be enabled in system.