Question

I need to allow administrators to manage permissions for models on my site. Groups, Users, and Permissions are doing a great job of this right now. However, I also need to allow the administrators to manage the permissions of non-authenticated users – Anonymous Users. The docs say that anonymous user’s group is always empty, so how can I allow administration of their permissions?

Answer 1

It is strange to add permissions to anonymous users. Docs say:

Django’s permission framework does not have a place to store
permissions for anonymous users. However, it has a foundation that
allows custom authentication backends to specify authorization for
anonymous users. This is especially useful for the authors of
re-usable apps, who can delegate all questions of authorization to the
auth backend, rather than needing settings, for example, to control
anonymous access.

So you can set permissions to anon yuser, but with custom auth backend.
It is sometimes better to use declarative permission check, using decorators on the views with the needed permissions, like:

@permission_required('somemodel.can_add')
def add_model(request):

or leave it unrestricted for everyone(incl. anonymous user). Or some custom permission check..

Or if you want to have permissions anyway, you can always create a dummy user, let’s say "AnonUser", to give it permissions, and then checking permissions to have something like:

if not user.is_authenticated():
    dummy_user = User.objects.get(name="AnonUser")
    if dummy_user.has_perm("somepermission"):
        # bla bla bla

but this is something I’d never use..