How can Django's AuthenticationMiddlewear not return a user object in the request

Question

My settings has the following MIDDLEWARE_CLASSES defined:

MIDDLEWARE_CLASSES = (
'django.middleware.common.CommonMiddleware',
'django.contrib.sessions.middleware.SessionMiddleware',
'django.middleware.csrf.CsrfViewMiddleware',
'django.contrib.auth.middleware.AuthenticationMiddleware',
'django_cas.middleware.CASMiddleware',
'django.contrib.messages.middleware.MessageMiddleware',
)

Every now and then I get the following exception from django-cas on any page view:

Traceback (most recent call last):

 File "/storage/virtualenvs/service.iqc.ca/lib/python2.6/site-packages/django/core/handlers/base.py", line 80, in get_response
   response = middleware_method(request)

 File "/storage/virtualenvs/service.iqc.ca/lib/python2.6/site-packages/django_cas/middleware.py", line 25, in process_request
   assert hasattr(request, 'user'), error

AssertionError: The Django CAS middleware requires authentication middleware to be installed. Edit your MIDDLEWARE_CLASSES setting to insert 'django.contrib.auth.middleware.AuthenticationMiddleware'.

I theorize that is has something to do with my cookies/session/cas being in a bad state because it will work with a fresh browser.

I am trying to imagine what might be going wrong so I can investigate further. Can the AuthenticationMiddlewear ever return a request object which has no user attribute set? This should be the only this which causes the assert in django_cas to fail.

If sessions are stale could request.user be undefined and it is a problem which is ignored the AuthenticationMiddleware alone?

Answer 1

request.user isn't undefined, but accessing it (through the LazyUser) throws an exception. This happened because I changed the name of my django_cas backend, but the existing sessions still had the old backend name set.

If you change the name of your django_cas backend (or any authentication backend) it will cause all your previous sessions to throw server errors.