CODEWITHSUNDEEP
pythondjangopostgresqlauthentication
hböhmer
hböhmer

Reputation: 1

Change user used to access database connected to django website in runtime

Currently I implemented a login routine for the website I am working on, according to This Tutorial.

Also I am not authenticating the user with djangos own system, because I am using authentication against the LDAP of my company (django-auth-ldap).

Currently I am using a general user to login to the database, which has universal access to all data, which also gives full access to any user logging in to the website.

To avoid that I would like to know how I can connect to the database as the individual user, who just logged in to the website.

Thanks in advance and sorry for bad english

Upvotes: 0

Views: 392

Answers (2)

t3chn0tr0n
t3chn0tr0n

Reputation: 1

hi! If I'm getting your problem correctly, the user you are creating is a Super User every time right?

Well if you are using Django auth.User model, you can just make User_object.is_super to False and then restrict the access of users though if-else in view! (User_object is the object of the auth.User model)

Does that made any sense?

//BTW, a side-note, a mistake I made while making my first custom user model: make sure to store your passwords hashed using Django hashes and salts!

Upvotes: 0

Risadinha
Risadinha

Reputation: 16666

Restricting user access to functionality and authenticating with the DB are handled separately in Django. You might be able to read the privileges of your users from the DB and map them to Django permissions but this is non-trivial (about Permissions see https://docs.djangoproject.com/en/2.1/topics/auth/default/#permissions-and-authorization).

In a UI/UX that has functionalities restricted depending on authorization, the frontend and backend need to be aware that permissions need to be checked and missing authorization needs to be communicated in some way or other to the user.

Example:

Users in group A are allowed to delete X. They see the "delete" button and there might also be an AJAX call that can delete X.

Users in group B are not allowed to delete X. They do not see the delete button and the AJAX call that can delete X needs to check for that permission and/or user group membership.

If you are only using a DB level authorization layer than - how would you know if the "delete" button should be displayed and for what to check in the AJAX call?

Upvotes: 1

Related Questions