Должны ли `Users` существовать в Django для SSO?

По сути, я реализую следующую функциональность, где фронт-енд будет отправлять подписанные JWT на бэкенд. Если бэкэнд сможет расшифровать и, следовательно, проверить токен (т. е. подпись, утверждения, аудиторию и т. д.), то он предоставит доступ к защищенным ресурсам API:

Now the users already exist in Azure AD (so I don't want to have to create/manage users in the Django DB as well). So essentially all I want to do is protect the Django Restful API endpoints with validated Access Tokens. I was looking at Custom Authentication (by extending rest_framework.authentication. BaseAuthentication) but it seems that the authenticate method expects a User to be matched (Hence Users to exist) and returned for a successful authentication (I would like to just pass if JWT validation is a success or raise Exception is there is an error).

Django docs:

Either way, authenticate() should check the credentials it gets and return a user object that matches those credentials if the credentials are valid. If they’re not valid, it should return None.

Я достиг желаемого потока (т.е. отсутствия пользователей Django), используя method_decorator, но это не похоже на правильный шаблон для аутентификации:

class ComponentViewSet(viewsets.ModelViewSet):
    queryset = Component.objects.all()
    serializer_class = ComponentSerializer

    @method_decorator(validate_jwt)
    def dispatch(self, *args, **kwargs):
        return super().dispatch(*args, **kwargs)

В документации по Django также говорится, что:

The Django admin is tightly coupled to the Django User object. The best way to deal with this is to create a Django User object for each user that exists for your backend (e.g., in your LDAP directory, your external SQL database, etc.).You can either write a script to do this in advance or your authenticate method can do it the first time a user logs in.

I have also done a separate implementation of the Custom Authentication by creating Users on the fly in the authenticate method just as the documentation recommended.

So my question is, is having Users exist in Django a strongly recommended design (or must according to the docs) even when you have a centrally managed Authentication system like LDAP/AD etc? Or is it also common not to use the Users model and use some other kind of implementation (for example the method decorator I used) when you don't intend to hold any kind of User information in the backend because I see it as redundant? Are there any advantages of duplicating a users database in the Django backend if it is strongly recommended. And do these users also require passwords if they extend django.contrib.auth.models.User?

Вернуться на верх