Custom authentication backend works but doens't work with Django Rest's Token Authentication

huangapple
go评论90阅读模式
英文:

Custom authentication backend works but doens't work with Django Rest's Token Authentication

问题

我的用户模型有一个电子邮件字段和一个用户名字段。USERNAME_FIELD被设置为电子邮件。但是我编写了一个身份验证后端，以支持使用用户名登录：

  1. class UsernameAuthBackend(BaseBackend):
  2.     def authenticate(self, request, email=None, password=None):
  3.         try:
  4.             user = User.objects.get(username=email)
  5.             if user.check_password(password):
  6.                 return user
  7.             return None
  8.         except User.DoesNotExist:
  9.             return None
  11.     def get_user(self, user_id):
  12.         try:
  13.             return User.objects.get(pk=user_id)
  14.         except User.DoesNotExist:
  15.             return None

settings.py:

  1. AUTHENTICATION_BACKENDS = [
  2.     "django.contrib.auth.backends.ModelBackend",
  3.     "accounts.authentication.UsernameAuthBackend",
  4. ]

这个方法可以正常工作，但是我无法使用用户名来获取用户的令牌（也无法在Django的管理面板上工作）。

英文:

My User model has an email field and a username field. `USERNAME_FIELD' is set to email. But I wrote an authentication backend to also support logging in using username:

  1. class UsernameAuthBackend(BaseBackend):
  2.     def authenticate(self, request, email=None, password=None):
  3.         try:
  4.             user = User.objects.get(username=email)
  5.             if user.check_password(password):
  6.                 return user
  7.             return None
  8.         except User.DoesNotExist:
  9.             return None
  11.     def get_user(self, user_id):
  12.         try:
  13.             return User.objects.get(pk=user_id)
  14.         except User.DoesNotExist:
  15.             return None

settings.py:

  1. AUTHENTICATION_BACKENDS = [
  2.     "django.contrib.auth.backends.ModelBackend",
  3.     "accounts.authentication.UsernameAuthBackend",
  4. ]

This works fine but it I can't use usernames with obtain_auth_token to get a user's token. (It also doesn't work on Django's admin panel.)

答案1

得分: 1

DRF

覆盖序列化器可以提供一种更简洁的方式来调整obtain_auth_token的身份验证数据输入。这是因为实际的身份验证逻辑通常在序列化器内部处理。

以下是如何创建一个自定义序列化器来处理电子邮件和用户名的方法：

  1. 自定义身份验证序列化器：
  1. from rest_framework.authtoken.serializers import AuthTokenSerializer
  2. from rest_framework import serializers
  3. from django.contrib.auth import authenticate
  5. class CustomAuthTokenSerializer(AuthTokenSerializer):
  6.     username = serializers.CharField(label="Username or Email")
  8.     def validate(self, attrs):
  9.         username_or_email = attrs.get('username')
  10.         password = attrs.get('password')
  12.         # 首先尝试使用电子邮件进行身份验证
  13.         try:
  14.             user = User.objects.get(email=username_or_email)
  15.         except User.DoesNotExist:
  16.             # 如果电子邮件不存在，则尝试使用用户名进行身份验证
  17.             try:
  18.                 user = User.objects.get(username=username_or_email)
  19.             except User.DoesNotExist:
  20.                 msg = '无法使用提供的凭据登录。'
  21.                 raise serializers.ValidationError(msg, code='authorization')
  23.         if not user.check_password(password):
  24.             msg = '无法使用提供的凭据登录。'
  25.             raise serializers.ValidationError(msg, code='authorization')
  27.         attrs['user'] = user
  28.         return attrs
  1. 更新CustomObtainAuthToken视图以使用自定义序列化器：
  1. from rest_framework.authtoken.views import ObtainAuthToken
  2. from rest_framework.authtoken.models import Token
  3. from rest_framework.response import Response
  4. from .serializers import CustomAuthTokenSerializer  # 调整导入路径
  6. class CustomObtainAuthToken(ObtainAuthToken):
  7.     serializer_class = CustomAuthTokenSerializer
  9.     def post(self, request, *args, **kwargs):
  10.         serializer = self.serializer_class(data=request.data, context={'request': request})
  11.         serializer.is_valid(raise_exception=True)
  12.         user = serializer.validated_data['user']
  13.         token, created = Token.objects.get_or_create(user=user)
  14.         return Response({'token': token.key})

通过这种方式，在序列化器的validate方法中处理确定输入是用户名还是电子邮件的逻辑，使视图更简单，并与Django REST framework的模式更一致。

Django Admin

您可以使用django-username-email包或覆盖默认的身份验证表单以允许基于用户名的身份验证。以下是一种基本的方法：

  1. from django import forms
  2. from django.contrib.auth.forms import AuthenticationForm
  3. from django.contrib.auth import authenticate
  5. class CustomAdminAuthForm(AuthenticationForm):
  6.     def clean(self):
  7.         username_or_email = self.cleaned_data.get('username')
  8.         password = self.cleaned_data.get('password')
  10.         if username_or_email and password:
  11.             self.user_cache = authenticate(self.request, email=username_or_email, password=password)
  12.             if self.user_cache is None:
  13.                 raise forms.ValidationError(
  14.                     self.error_messages['invalid_login'],
  15.                     code='invalid_login',
  16.                     params={'username': self.username_field.verbose_name},
  17.                 )
  18.         return self.cleaned_data
  20. # 更新您的admin.py
  21. from django.contrib import admin
  22. from .forms import CustomAdminAuthForm
  24. admin.site.login_form = CustomAdminAuthForm

请注意，上述代码片段更多是概念性的，而不是确切的代码。

英文:

DRF

You can overriding the serializer can provide a cleaner way to adjust the authentication data input for obtain_auth_token. This is because the actual authentication logic is often handled within the serializer.

Here's how you can create a custom serializer to handle both email and username:

  1. Custom Authentication Serializer:
  1. from rest_framework.authtoken.serializers import AuthTokenSerializer
  2. from rest_framework import serializers
  3. from django.contrib.auth import authenticate
  5. class CustomAuthTokenSerializer(AuthTokenSerializer):
  6.     username = serializers.CharField(label="Username or Email")
  8.     def validate(self, attrs):
  9.         username_or_email = attrs.get('username')
  10.         password = attrs.get('password')
  12.         # Try authentication with email first
  13.         try:
  14.             user = User.objects.get(email=username_or_email)
  15.         except User.DoesNotExist:
  16.             # If email doesn't exist, check with username
  17.             try:
  18.                 user = User.objects.get(username=username_or_email)
  19.             except User.DoesNotExist:
  20.                 msg = 'Unable to log in with provided credentials.'
  21.                 raise serializers.ValidationError(msg, code='authorization')
  23.         if not user.check_password(password):
  24.             msg = 'Unable to log in with provided credentials.'
  25.             raise serializers.ValidationError(msg, code='authorization')
  27.         attrs['user'] = user
  28.         return attrs
  1. Update CustomObtainAuthToken View to use the Custom Serializer:
  1. from rest_framework.authtoken.views import ObtainAuthToken
  2. from rest_framework.authtoken.models import Token
  3. from rest_framework.response import Response
  4. from .serializers import CustomAuthTokenSerializer  # Adjust the import path
  6. class CustomObtainAuthToken(ObtainAuthToken):
  7.     serializer_class = CustomAuthTokenSerializer
  9.     def post(self, request, *args, **kwargs):
  10.         serializer = self.serializer_class(data=request.data, context={'request': request})
  11.         serializer.is_valid(raise_exception=True)
  12.         user = serializer.validated_data['user']
  13.         token, created = Token.objects.get_or_create(user=user)
  14.         return Response({'token': token.key})

This way, you're handling the logic of determining whether the input is a username or email in the serializer's validate method, making the view simpler and more consistent with Django REST framework's patterns.

Django Admin

You can use django-username-email package or override the default authentication form to allow for username-based authentication. Here's a basic approach:

  1. from django import forms
  2. from django.contrib.auth.forms import AuthenticationForm
  3. from django.contrib.auth import authenticate
  5. class CustomAdminAuthForm(AuthenticationForm):
  6.     def clean(self):
  7.         username_or_email = self.cleaned_data.get('username')
  8.         password = self.cleaned_data.get('password')
  10.         if username_or_email and password:
  11.             self.user_cache = authenticate(self.request, email=username_or_email, password=password)
  12.             if self.user_cache is None:
  13.                 raise forms.ValidationError(
  14.                     self.error_messages['invalid_login'],
  15.                     code='invalid_login',
  16.                     params={'username': self.username_field.verbose_name},
  17.                 )
  18.         return self.cleaned_data
  20. # Update your admin.py
  21. from django.contrib import admin
  22. from .forms import CustomAdminAuthForm
  24. admin.site.login_form = CustomAdminAuthForm

Please note that the above code snippets are more conceptual than exact code.

huangapple
  • 本文由 发表于 2023年8月9日 01:59:30
  • 转载请务必保留本文链接：https://go.coder-hub.com/76862111.html
  • django
  • django-rest-auth
  • django-rest-framework
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定