we are trying to use google apps' SAML capabilities for our custom apps. In order to pass user roles to our apps we are looking into custom user fields (https://developers.google.com/admin-sdk/directory/v1/guides/manage-schemas). One thing we are struggling with is to automatically assign a default schema to newly created google apps accounts.
Is this somehow doable? Do we miss some option?
Or is there a different approach for this topic?
Thanks for your help.
Related
I am creating a flask app to be used internally in my company. I would like to restrict what a user can do it based on its login ID. I read a lot about using LDAP3 but I don't think I can do what want which send the login ID to the server. There I would have a table which will register which part of the system has the permition to edit. If it try to change somenthing not permited the app will retrieve a warning message.
I won't to do that to avoid having to create a separate login functionality just for this app. I read that I should use AD authentication but I am not very familiarized with that and I would also like to avoid having to ask our IT department to create user groups there for each part of my system.
I know that I can do that using ASP .NET (at least I did once).
Any guidance will be apreciated.
I think you are looking for Role-based Authorization.
In order to use this functionality you will need to implement roles on your model file per the Data-models documentation.
This will allow you to assign users a role when they are created, and you can use a decorator on your routes to 'require' the user to have the role you want them to have before they access the endpoint.
I'm new to Django so I have some questions that might seem basic to you. I'm looking to create a platform that is open to both individuals and companies and I'm trying to design the user auth for an API that runs on DRF. I need to provide mobile platform access so I'm thinking of using OAuth via django-oauth-toolkit. Having difficulty understanding:
Should I separate the login flow into a separate app? How do I know when I should spin up a separate app?
Do I manage the profiles via the built in admin area? Is this secure for production environments?
Should I separate individual profiles and company profiles into separate apps or just models extending the Base User?
How do I allow the individual profiles to link their logins to social media accounts with django-allauth while storing extra information like birthday/name etc regardless of which mode of login?
Thanks!
This is my point of view.
No need to separate the app. You can manage all the profiles from
Django admin.
It is secure for production environments, django not allow to see
its credentials or password to anyone, its encrypted.
You can create UserProfile model and use django user as Foreignkey
in this. You can able to add extra field like in this way. OR you
can extends the User model of Django admin.
Its just a suggest, you do whatever you feel reliable or easy way.
How to implement multiple authentication with one model named User? There are different roles attached to this model. I need to implement multiple authentication as user and administrator.
Better not to call it “multi authentication”. Multi authentication is a completely different conecpt. Basically you will have to have 2 guards setup.
But if you are using one single guard (user guard in this case) you will have to simply assign roles by creating a new column in users model called “roles” or what ever you prefer.
After you have setup the roles colum in your users model, create a middleware and configure the rest. Explanation:
In your “role” middleware or whatever you prefer, specify what roles are which and who has access to where. And include that middleware inside your controller in use.
If you stil want to have a multi authentication like one login and redirect separately for users and administrators, I’d suggest you to look at “the dev marketer” multi auth tutorial. It is a well explained and all the source code can be found in whole on github.
Keep in mind that the laravels default /login route is meant for normal user login (atleast for me). You can create a /admin/login route with the above mentioned tutorial.
Hope this helps. Good luck :)
I have a project using django. And now the need for having to completely separated auth system(with different tables, authentication back-end, users, user-info etc) comes in scene.
Is there any way to make django instead of setting request.user, sets request.myotherappuser?
What about the default auth system, can I still use it to authenticate those 'new users' and also log them in?
Thanks in advance.
I'm assuming from your phrase "authenticate those 'new users' and also log them in" that you have some legacy system from which you wish to authenticate people?
Why not write a custom authentication backend that logs people in against the old backend, and then also creates them a "new" account in django.contrib.auth?
You could also create an extension to the user model using Dj1.5 that allows you to reference the "old" table like request.user.myappotheruser.
Django-Social in its feature list claims that it supports associating multiple authentication providers to a single user account.
I can't seem to figure out how to use that feature.
When I try to login using a new authentication provider it automatically seems to be creating a new account for each provider.
Any ideas?
Sarvi
Take a look to django-social-auth, it's simpler and easier to setup than Django-Socialauth.
Multiple account association is supported but limited to logged in users to avoid the decision of which user instance must be removed.
it supports associating multiple authentication providers to a single user account
By looking at the code for models.py here, socialauth has a UserProfile for each provider, associating them to the User object which you use for basic authentication. So indeed, what it claims is true.
It can be done manually through admin once you have logged in with multiple accounts. Then the Socialauth models for the accounts can be adjusted to point at the User they are required too and multiple accounts can point to the same user.
But I have not had a good enough look to work out how to let users do this automatically for themselves. It does not work out of the box if you sign in to another account if while already signed into an existing account.