Question

I’ve been searching here and there, and based on this answer I’ve put together what you see below.
It works, but I need to put some stuff in the user’s session, right there inside authenticate.

How would I store acme_token in the user’s session, so that it will get cleared if they logged out? The request object is not available in this context

class AcmeUserBackend(object):
    # Create a User object if not already in the database?
    create_unknown_user = False

    def get_user(self, username):
        return AcmeUser(id=username)

    def authenticate(self, username=None, password=None):
        """ Check the username/password and return an AcmeUser. """
        acme_token = ask_another_site_about_creds(username, password)

        if acme_token:
            return AcmeUser(id=username)
        return None

Answer 1

Shove it onto the returned user, then handle it in middleware.