Question

I implemented a django custom authentication backend. My authenticate() returns a user object like this return User(username=username, password=password), but I never store the User object to a database.

1. Why do do the django docs recommend creating a database with user objects? (https://docs.djangoproject.com/en/1.4/topics/auth/#writing-an-authentication-backend – “…the best way to deal with this is to create a Django User object for each user that exists for your backend…”)

2. If I try calling login(), there’s a call made to the database. If logins are stored in sessions, why is a database necessary? (Using cached sessions)

Answer 1

The reason why you specifically need to save the User object is that it’s common for apps to create database level relationships between objects and users (in order to persist the relationship across multiple requests).

A simple example would be the activity log in django.contrib.admin. It displays recent behaviour that users have performed. This only works when the user object is saved to the database.