External authentication for Django projects
summary
Django 1.9 adds PersistentRemoteUserMiddleware so external auth from an Apache front end survives normal sessions; the demo uses FreeIPA + Kerberos (GSSAPI) and SAML via mod_auth_mellon, with SSSD and mod_lookup_identity to map attributes. Accounts (Bob, Penny) are auto-created, email and names are populated, and group membership propagates into Django groups using an X-prefix mapping; the prototype works end to end in the demo, including login redirects and permission assignment.
AI-written summary · about
chapters (12)
- 0:00Intro
- 0:22Situation
- 2:43Problem statement
- 4:06Simple setup
- 6:44Authentication in frontend HTTP server
- 8:05Limits of RemateuserMiddleware
- 9:20Authentication on single URL
- 12:16Additional user attributes
- 14:01Consuming attributes in Django
- 17:29Group-based authorization
- 20:35Populating REMOTE_USER_GROUP_+
- 27:12Conclusion
related talks
26mDeveloping a Single Sign On Service using Django
37mDjango + Keycloak: trust authentication to the professionals
19mImpress your enterprise customers with OpenID Connect login
44mManaging Identities: LDAP, Google Directory, and Django
25mUnderstanding Django authentication
26mIntegrating 2 factor authentication into your project
38mBuilding a multi factor SSO for a whole country with Django
15mDjango URL Pattern Role Authorization System