Django - auth user with the email domain and no password

Question

I have a request to alter a standard Django login of email and password to allow any user login without a password, but only if they are on a certain domain ... e.g. [email protected] ... where the user is allowed in due to them being on the correct domain.

Any suggestions?

Thanks

Answer 1

If your user has an openid with the email [email protected] then you can use an OpenId solution (say Django-openid; there are others too) to verify his identity and allow him access.

If that is unlikely, then you'll need to find a custom way of ensuring that the user is who he claims to be.

Answer 2

Somehow like this:

if cleaned_data['email'].endswith('@example.com'):
    user = None
    try:
        user = User.objects.get(email = cleaned_data['email'])
    except:
        pass
    if user:
        login(request, user)

Your concept allows everyone knowing or guessing one of the affected email-addresses to login without using a password!

Best regards!

Answer 3

Assuming that 'being on the correct domain' means they have an email address for the relevant domain, you could write a custom authentication backend that

• looks to check that there is a single user with that email address (and not more than one, which will also mean updating registration flows to ensure email addresses are guaranteed unique, plus possibly checking your DB for duplicates already, just in case)
• gets that User and splits off the domain of their email address to check it against a list/whatever of allowed no-password-required domains
• return the User from your custom auth backend as if the normal password check had been satisfied, even though it was never checked with check_password(). The Django docs and various djangosnippets.org snippets show how to do this.

In addition:

• you will have to use a new/overridden authentication Form class for the admin login view that doesn't require a password field (but still shows it for non-special logins), so that it doesn't complain if there is no password entered.

And finally:

• get religion, if you don't already have it
• pray to your G/god(s) that no one else learns that the site that will allow no-password authentication with an email address, and especially that they don't also get hold of the email address(es) in question, particularly if your site holds ANY personal data about third parties or has to be PCI-DSS compliant etc, etc.
• strongly consider saying 'No' to your client/user/manager/whoever requested this, for the reason immediately above. Passwords are used for a reason.

Or, finally, finally:

• skip all of the above and tell your client/user/manager about some of the various password storage tools out there - eg this and this

Answer 4

Thanks all. I managed to convince the client of the BAD idea of no password. However, they do want a single password, but [email protected] ... So, it looks like a "custom authentication backend". I'm completely new to Django .. and am not having much fun here .. (no-one else available to help that does know it .. great ... at least the deadline isn't today .. oh wait ..)