User authentication in Django 阅读批注

原文：https://docs.djangoproject.com/en/1.6/topics/auth/

User authentication in Django

Django comes with a user authentication system. It handles user accounts, groups, permissions and cookie-based user sessions. This section of the documentation explains how the default implementation works out of the box, as well as how to extend and customize it to suit your project’s needs.

★Django 认证系统，可以处理用户accounts，组（groups），权限（permissions）和基于cookie的用户session 。此文解释了如何使用默认的认证功能和如何扩展定制。

Overview

The Django authentication system handles both authentication and authorization. Briefly, authentication verifies a user is who they claim to be, and authorization determines what an authenticated user is allowed to do. Here the term authentication is used to refer to both tasks.

★ Django 认证系统包括鉴定（authentication）和授权（authorization），鉴定系统认证用户是谁，授权系统决定被认证过的用户能做什么。

The auth system consists of:

• Users ★用户
• Permissions: Binary (yes/no) flags designating whether a user may perform a certain task. ★ 权限
• Groups: A generic way of applying labels and permissions to more than one user. ★ 组
• A configurable password hashing system ★ 可配置的哈希密码系统
• Forms and view tools for logging in users, or restricting content ★ 给已登录用户使用的表单和视图工具，或限制的内容
• A pluggable backend system ★ 可插可拔的后端系统

The authentication system in Django aims to be very generic and doesn’t provide some features commonly found in web authentication systems. Solutions for some of these common problems have been implemented in third-party packages:

★因为 Django 认证系统很通用，所以没有把所有功能放在一个系统里。 第三方插件可以实现默认认证系统没有包含的功能。

• Password strength checking ★ 密码强度检查
• Throttling of login attempts ★ 暴力破解的检查
• Authentication against third-parties (OAuth, for example) ★ 第三方认证

Installation

Authentication support is bundled as a Django contrib module in django.contrib.auth. By default, the required configuration is already included in the settings.py generated by django-admin.py startproject, these consist of two items listed in your INSTALLED_APPS setting:

★Django 的认证系统被放在了 django.contrib.auth 模块里。通常在创建工程时被默认放在了 INSTALLED_APPS 里。

1. 'django.contrib.auth' contains the core of the authentication framework, and its default models.
2. 'django.contrib.contenttypes' is the Django content type system, which allows permissions to be associated with models you create.

and two items in your MIDDLEWARE_CLASSES setting:

1. SessionMiddleware manages sessions across requests.
2. AuthenticationMiddleware associates users with requests using sessions.

With these settings in place, running the command manage.py syncdb creates the necessary database tables for auth related models, creates permissions for any models defined in your installed apps, and prompts you to create a superuser account the first time you run it.

Usage

Using Django’s default implementation

• Working with User objects
• Permissions and authorization
• Authentication in web requests
• Managing users in the admin

API reference for the default implementation

Customizing Users and authentication

Password management in Django