Forhad Khan

Posted on Jul 12, 2023

Multi-Role User Authentication in Django Rest Framework

#django #djangorestframework #python #multiroleuserauthentication

Introduction:

User authentication is a fundamental aspect of many web applications. Django provides a powerful authentication system out-of-the-box, but sometimes you need to extend it to support multiple user roles. In this post, we'll explore how to implement multi-role user authentication using Django Rest Framework (DRF).

Setting Up the Project:

Let's start by creating a new Django project. If you don't have a Django environment set up, you can create one by following these steps:

Create a virtual environment: python -m venv venv
Activate the virtual environment: venv\Scripts\activate

Once your environment is activated, install Django and Django Rest Framework:

pip install django djangorestframework

You can follow any approach you prefer to setup environment. When your env is ready, open terminal (with env activated) and run the following commands:

django-admin startproject multi_role_auth
cd multi_role_auth

Start our `authentication` app:

Open terminal (with env activated) and run the following commands:

python manage.py startapp authentication

Now that we have our project structure ready, let's dive into the implementation.

Defining User Model:

In the authentication/models.py file, we'll define a custom user model that extends the AbstractUser class from Django's authentication models. This model will include a role field to assign different roles to each user.

# authentication/models.py

from django.db import models
from django.contrib.auth.models import AbstractUser
from django.conf import settings
from rest_framework.authtoken.models import Token


class User(AbstractUser):
    ROLE_CHOICES = (
        ('administrator', 'Administrator'),
        ('teacher', 'Teacher'),
        ('student', 'Student'),
        ('staff', 'Staff'),
    )

    role = models.CharField(max_length=15, choices=ROLE_CHOICES)

Feel free to customize the ROLE_CHOICES tuple to include the specific roles that are relevant to your application. Additionally, if you require more fields for the User model, you can easily add them to this model. You can refer to the documentation to explore all the default fields provided by Django's User model. This flexibility allows you to tailor the User model to meet the specific requirements of your project.

Creating Serializers:

Next, create serializers for our authentication app. Serializers help in converting complex data types into JSON, making it easy to send data over HTTP.

Create authentication/serializers.py and add the following code:

# authentication/serializers.py

from rest_framework import serializers
from .models import User

class UserSerializer(serializers.ModelSerializer):
    class Meta:
        model = User
        fields = ['username', 'email', 'role', 'password']
        extra_kwargs = {'password': {'write_only': True}}

    def create(self, validated_data):
        user = User.objects.create_user(**validated_data)
        return user

Here, we've defined a UserSerializer that inherits from the ModelSerializer provided by DRF. We specify the model as our custom User model and define the fields to include in the serialized representation. Additionally, we set the "password" field as write-only to prevent it from being exposed in responses. In the fields attribute, you can include all fields by passing fields = '__all__'.

Creating Views:

Now, let's implement the views for user registration, login, and logout.

In authentication/views.py, add the following code:

# authentication/views.py

from authentication.models import User
from authentication.serializers import UserSerializer
from django.contrib.auth import authenticate, login
from rest_framework import status
from rest_framework.response import Response
from rest_framework.views import APIView
from rest_framework.authtoken.views import ObtainAuthToken
from rest_framework.authtoken.models import Token
from rest_framework.permissions import IsAuthenticated


class UserRegistrationView(APIView):
    def post(self, request):
        serializer = UserSerializer(data=request.data)
        if serializer.is_valid():
            serializer.save()
            return Response(serializer.data, status=status.HTTP_201_CREATED)
        return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)



class UserLoginView(ObtainAuthToken):
    def post(self, request, *args, **kwargs):
        username = request.data.get('username')
        password = request.data.get('password')

        user = authenticate(request, username=username, password=password)
        if user is not None:
            login(request, user)
            token, created = Token.objects.get_or_create(user=user)
            if created:
                token.delete()  # Delete the token if it was already created
                token = Token.objects.create(user=user)
            return Response({'token': token.key, 'username': user.username, 'role': user.role})
        else:
            return Response({'message': 'Invalid username or password'}, status=status.HTTP_401_UNAUTHORIZED)



class UserLogoutView(APIView):
    permission_classes = [IsAuthenticated]

    def post(self, request):
        print(request.headers) 
        token_key = request.auth.key
        token = Token.objects.get(key=token_key)
        token.delete()

        return Response({'detail': 'Successfully logged out.'})

In the UserRegistrationView, we handle the HTTP POST request for user registration. We validate the data using the UserSerializer and save the user if it's valid.

In the UserLoginView, we handle the user login functionality. We authenticate the user using the provided username and password, and if successful, generate a token using the Token model from DRF. We return the token along with the username and role in the response.

The UserLogoutView is responsible for logging out the authenticated user. It retrieves the token from the request's authentication header, deletes the token if it exists, and returns a success message.

Updating URLs:

Finally, we need to define the URLs for our authentication app.

In multi_role_auth/urls.py, add the following code:

# multi_role_auth/urls.py

from django.urls import path, include
from authentication.views import UserRegistrationView, UserLoginView, UserLogoutView

urlpatterns = [
    path('api/auth/register/', UserRegistrationView.as_view(), name='user-registration'),
    path('api/auth/login/', UserLoginView.as_view(), name='user-login'),
    path('api/auth/logout/', UserLogoutView.as_view(), name='user-logout'),
    # Add other URLs here
]

Here, we map
/api/auth/register/ URL to the UserRegistrationView,
/api/auth/login/ URL to the UserLoginView, and
api/auth/logout/ URL to the UserLogoutView.

Modifying `settings.py`:

To enable token-based authentication in DRF, we need to make some modifications to the settings.py file.

In "multi_role_auth/settings.py", add or update the following settings:

# multi_role_auth/settings.py

# ...

INSTALLED_APPS = [
    # ...
    'rest_framework',
    'rest_framework.authtoken',
    'authentication',
]

# ...

AUTH_USER_MODEL = 'authentication.User'

REST_FRAMEWORK = {
    'DEFAULT_AUTHENTICATION_CLASSES': [
        'rest_framework.authentication.TokenAuthentication',
    ],
}

Here, we've added rest_framework and authentication to the INSTALLED_APPS list to include the necessary packages. Additionally, we've configured the DEFAULT_AUTHENTICATION_CLASSES to use the TokenAuthentication class for token-based authentication.

Remember to run migrations before testing the app:

python manage.py makemigrations
python manage.py migrate

Test:

Here I tested authentication endpoints using Postman

Register a user:
Send a POST request to http://localhost:8000/api/auth/register/ with the following payload in the request body:

{
  "username": "johndoe",
  "email": "johndoe@example.com",
  "password": "$tr0ngPa$$w0rd",
  "role": "student"
}

Login:
Send a POST request to http://localhost:8000/api/auth/login/ with the following payload in the request body:

{
  "username": "johndoe",
  "password": "$tr0ngPa$$w0rd"
}

Logout:
Send a POST request to http://localhost:8000/api/auth/logout/ with the token in the request headers. Include an Authorization header with the value Token {token} (replace {token} with the actual token value obtained during login).

Use it in user-specific class(es)

Now that we have a User with the role field, we can use it in our user-specific classes. For example:

# student/models.py  

from django.db import models
from authentication.models import User

class Student(models.Model):
    # other fields related to student ...
    student_id = models.CharField(max_length=10, unique=True)
    user = models.OneToOneField(User, on_delete=models.CASCADE, related_name="student_account")

# student/serializers.py  
# import ...
class StudentSerializer(serializers.ModelSerializer):
    user = UserSerializer(read_only=True)

    class Meta:
        model = Student
        fields = '__all__'

    def create(self, validated_data):
        user_data = validated_data.pop('user')
        user = User.objects.create_user(**user_data)
        student = Student.objects.create(user=user, **validated_data)
        return student

Update views and URLs:

# ...
class StudentRegistrationView(APIView):
    def post(self, request):
        serializer = StudentSerializer(data=request.data)
        if serializer.is_valid():
            serializer.save()
            return Response(serializer.data, status=status.HTTP_201_CREATED)
        return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)

# Update Login view
class UserLoginView(ObtainAuthToken):
    def post(self, request, *args, **kwargs):
        username = request.data.get('username')
        password = request.data.get('password')

        user = authenticate(request, username=username, password=password)
        if user is not None:
            login(request, user)
            token, created = Token.objects.get_or_create(user=user)
            if created:
                token.delete()  # Delete the token if it was already created
                token = Token.objects.create(user=user)

            response_data = {
                'token': token.key,
                'username': user.username,
                'role': user.role,
            }

            if user.role == 'student':
                student = user.student_account  # Assuming the related name is "student_account"
                if student is not None:
                    # Add student data to the response data
                    student_data = StudentSerializer(student).data
                    response_data['data'] = student_data

            return Response(response_data)
        else:
            return Response({'message': 'Invalid username or password'}, status=status.HTTP_401_UNAUTHORIZED)

# ... 
urlpatterns = [
    # ...
    path('api/auth/register/student/', StudentRegistrationView.as_view(), name='student-registration'),
    # ...
]

In case you created a new app for student, add it to INSTALLED_APPS.
Run migrations.

Here is a JSON data to register a Student:

{
    "student_id": "1234567890",
    "user": {
        "username": "john_doe@stu",
        "email": "john.doe@test.com",
        "role": "student",
        "password": "secretpassword"
    }
}

And this is the login response:

{
    "token": "bc2369f6cf4c7bf015c449773dc285e9e8c69caf",
    "username": "john_doe@stu",
    "role": "student",
    "data": {
        "id": 1,
        "user": {
            "username": "john_doe@stu",
            "email": "john.doe@test.com",
            "role": "student"
        },
        "student_id": "1234567890"
    }
}

Conclusion:

In this tutorial, we've covered the process of implementing multi-role user authentication using Django Rest Framework. We defined a custom user model, created serializers for user registration and login, implemented views for user registration, login, and logout, and updated the project's URLs and settings to support token-based authentication. Furthermore, we have explored the detailed process of utilizing our customized User model in other specific models.

By extending Django's built-in user model and utilizing the capabilities of Django Rest Framework, you can easily add role-based authentication to your Django applications. This allows you to differentiate user permissions and provide tailored experiences based on each user's role.

Feel free to explore further and add additional functionalities, such as password reset and role-based access control (RBAC), based on your application requirements.

Happy coding!

Top comments (4)

mosesmbadi • Jul 24 '23

Great job Forhad! Moses here reading from Kenya. I have a question, using this implementation, how can we configure access per role. Imagine this, a client submits a ticket, which there is a head engineer who assigns to to service engineers and when its complete the client is notified. How can I adapt this authentication to that kind of authorization. Thanks

Forhad Khan • Aug 1 '23

Hello Moses, you can configure access per role by defining custom permission classes in Django Rest Framework (DRF). In your case, you can create three custom permission classes to handle the different roles: IsClient, IsHeadEngineer, and IsServiceEngineer. Then, you can use these permission classes in your views to enforce role-based access control. Here's how you can do it:

Define custom permission classes for each role:

# authentication/permissions.py

from rest_framework.permissions import BasePermission

class IsClient(BasePermission):
    def has_permission(self, request, view):
        return request.user.role == 'client'

class IsHeadEngineer(BasePermission):
    def has_permission(self, request, view):
        return request.user.role == 'head_engineer'

class IsServiceEngineer(BasePermission):
    def has_permission(self, request, view):
        return request.user.role == 'service_engineer'

Use the custom permission classes in your views:

# views.py

from rest_framework.views import APIView
from authentication.permissions import IsClient, IsHeadEngineer, IsServiceEngineer

class TicketSubmissionView(APIView):
    permission_classes = [IsClient]

    def post(self, request):
        # Your ticket submission logic here
        pass

class AssignmentView(APIView):
    permission_classes = [IsHeadEngineer]

    def put(self, request, ticket_id):
        # Your assignment logic here
        pass

class CompletionView(APIView):
    permission_classes = [IsServiceEngineer]

    def put(self, request, ticket_id):
        # Your completion logic here
        pass

By using these custom permission classes, you ensure that only users with the appropriate roles can access the corresponding views. For example, TicketSubmissionView can only be accessed by users with the role client, AssignmentView can only be accessed by users with the role head_engineer, and CompletionView can only be accessed by users with the role service_engineer.

Remember that you need to set the role attribute for each user when they are created or updated, and make sure your authentication mechanism provides this information in the request.

I hope this helps you. Happy coding. Feel free to ask any question.

Achal Pathak • Jul 14 '23

What about handling same user with multiple roles?
For e.g. a user can be a teacher as well as administrator

Forhad Khan • Jul 18 '23

Good point Pathak. In case you want a user to have multiple roles, you can achieve that by modifying the models and serializers. Here is one approach to do it.

Modify the models - create a separate Role model and set a ManyToMany relationship to the roles field in the User class.

# authentication/models.py

from django.db import models
from django.contrib.auth.models import AbstractUser

class Role(models.Model):
    name = models.CharField(max_length=15, unique=True)

    def __str__(self):
        return self.name


class User(AbstractUser):
    roles = models.ManyToManyField(Role)

You will also need to update the UserSerializer to handle multiple roles:

from rest_framework import serializers
from .models import User, Role

class RoleSerializer(serializers.ModelSerializer):
    class Meta:
        model = Role
        fields = ['name']

class UserSerializer(serializers.ModelSerializer):
    roles = RoleSerializer(many=True)

    class Meta:
        model = User
        fields = ['username', 'email', 'roles', 'password']
        extra_kwargs = {'password': {'write_only': True}}

    def create(self, validated_data):
        roles_data = validated_data.pop('roles')
        user = User.objects.create_user(**validated_data)
        for role_data in roles_data:
            role, _ = Role.objects.get_or_create(**role_data)
            user.roles.add(role)
        return user

With these changes, you can now pass an array of roles during user registration, allowing a user to have multiple roles associated with their account.

For example, when creating a user with multiple roles, you can send a request like this:

{
    "username": "example_user",
    "email": "user@example.com",
    "password": "example_password",
    "roles": [
        {"name": "administrator"},
        {"name": "teacher"}
    ]
}

I hope this helps! Let me know if you have any further questions.

DEV Community

Multi-Role User Authentication in Django Rest Framework

Introduction:

Setting Up the Project:

Start our `authentication` app:

Defining User Model:

Creating Serializers:

Creating Views:

Updating URLs:

Modifying `settings.py`:

Test:

Use it in user-specific class(es)

Conclusion:

Top comments (4)

Read next

Python "Financial Health" Terminal Project

How to check if a variable is number in Python

Django 7 - Users login, logout and register

Solving Logs Woes: A Small Dive into Singleton Design Pattern

Introduction:

Setting Up the Project:

Start our authentication app:

Defining User Model:

Creating Serializers:

Creating Views:

Updating URLs:

Modifying settings.py:

Test:

Use it in user-specific class(es)

Conclusion:

Read next

Python "Financial Health" Terminal Project

How to check if a variable is number in Python

Django 7 - Users login, logout and register

Solving Logs Woes: A Small Dive into Singleton Design Pattern

Start our `authentication` app:

Modifying `settings.py`: