Docs: tell if user must have usble password or not about django-sesame HOT 3 CLOSED

Absolutely, considering that the documentation of django.contrib.auth says:

Authentication backends aren’t required to check for the is_active flag but the default backend (ModelBackend) and the RemoteUserBackend do.

Furthermore, based on code inspection, it seems to me that django-sesame doesn't honor the is_active flag. I think it should.

This should be a matter of checking if self.user_can_authenticate(user) in ModelBackend.authenticate.

We can make the same backwards-incompatible change that Django 1.10 did — I consider it's a bugfix:

The new AllowAllUsersModelBackend and AllowAllUsersRemoteUserBackend ignore the value of User.is_active, while ModelBackend and RemoteUserBackend now reject inactive users.

The current situation only exists because django-sesame predates Django 1.10 by 4 years and didn't account for this change.

While we're there, perhaps it would be best to move the authenticate method in the UrlAuthBackendMixin class, so we can do:

class ModelBackend(UrlAuthBackendMixin, auth_backends.ModelBackend):
    pass

class AllowAllUsersModelBackend(UrlAuthBackendMixin, auth_backends. AllowAllUsersModelBackend):
    pass

from django-sesame.

Upon further investigation, the current implementation honors is_active because it calls ModelUser.get_user. So this is a matter of tests and docs.

from django-sesame.

Many thanks Aymeric, it's so precious to have so well-maintained packages, and I mean it!

from django-sesame.