User authentication in Server

Server comes with a user authentication system. It handles user accounts, groups, permissions and cookie-based user sessions. This section of the documentation explains how the default implementation works out of the box, as well as how to extend and customize it to suit your project’s needs.


The Server authentication system handles both authentication and authorization. Briefly, authentication verifies a user is who they claim to be, and authorization determines what an authenticated user is allowed to do. Here the term authentication is used to refer to both tasks.

The auth system consists of:

  • Users
  • Permissions: Binary (yes/no) flags designating whether a user may perform a certain task.
  • Groups: A generic way of applying labels and permissions to more than one user.
  • A configurable password hashing system
  • Forms and view tools for logging in users, or restricting content
  • A pluggable backend system

The authentication system in Server aims to be very generic and doesn’t provide some features commonly found in web authentication systems. Solutions for some of these common problems have been implemented in third-party packages:

  • Password strength checking
  • Throttling of login attempts
  • Authentication against third-parties (OAuth, for example)
  • Object-level permissions


Authentication support is bundled as a Server contrib module in server.contrib.auth. By default, the required configuration is already included in the generated by os_sys-server-admin startproject, these consist of two items listed in your INSTALLED_APPS setting:

  1. 'server.contrib.auth' contains the core of the authentication framework, and its default models.
  2. 'server.contrib.contenttypes' is the Server content type system, which allows permissions to be associated with models you create.

and these items in your MIDDLEWARE setting:

  1. SessionMiddleware manages sessions across requests.
  2. AuthenticationMiddleware associates users with requests using sessions.

With these settings in place, running the command migrate creates the necessary database tables for auth related models and permissions for any models defined in your installed apps.