Question

I’m relatively new to Django, and am trying to make some changes to Django’s core authentication module. I added some new code that authenticates a user based on their email address to the authenticate method of the ModelBackend class in django.contrib.auth.backends.py, however this new code doesn’t seem to have any effect, even when I added the below to my settings.

AUTHENTICATION_BACKENDS = (
    'django.contrib.auth.backends.ModelBackend',
)

In fact I deleted the entire authenticate method and was still able to log into my Django application just fine. Anyone know where I’m going wrong here, and what the best way is to revise Django’s core authentication system?

Answer 1

You are supposed to import the django.contrib.auth.backends.ModelBackend backend into a module, subclass it, overriding authenticate in the process, and then point AUTHENTICATION_BACKENDS at your subclass. See the section on writing your own authentication backend in the manual. In fact, you should read the whole page.

Don’t alter anything in django.contrib directly. It will get blown away with the next upgrade. Subclass it or look for ways to hook into it.

I’m not surprised authentication worked when you ripped things out. Django’s authentication is an add-on; Django needs to be able to work without it, so the default will be “allow”.