Package: django-iam
Django Identity and Access ManagementRoles and access management for django appsQuick Setuppipinstalldjango-iamMake sure you have a custom user model setup and insettings.pyyou haveAUTH_USER_MODEL='users.User'# Point to your custom user modelAddiamto yourINSTALLED_APPS# settings.pyINSTALLED_APPS=['django.contrib.admin',...,# django apps'iam',...,# Your apps]AUTHENTICATION_BACKENDS=[...,'rules.permissions.ObjectPermissionBackend','django.contrib.auth.backends.ModelBackend',...]Create a profile for the role, e.g.# app/models.pyfromdjango.dbimportmodelsfromiam.factoriesimportAbstractProfileFactoryfromiam.contrib.utilsimportget_profile_cls_verbose_name_pluralclassSomeRoleProfile(AbstractProfileFactory.as_abstract_model(related_name='blog_author_profile'),models.Model):# user = models.OneToOneField(settings.AUTH_USER_MODEL, on_delete=models.PROTECT)  # comes from AbstractProfileFactoryclassMeta:# Adds a little 👤 emoji to the name in admin, to make it clear this is a profile modelverbose_name_plural=get_profile_cls_verbose_name_plural('BlogAdminProfile')In your app, create arules.py:# app/rules.pyimportrulesfromiam.utilsimportlazy_get_predicate# refer to https://github.com/dfunckt/django-rules#permissions-in-the-admin for why this is hererules.add_perm('some_app',rules.is_staff)is_some_role=lazy_get_predicate('some_app.SomeRole')In your model that you are planning to set access to:# app/models.pyfromrules.contrib.modelsimportRulesModelfromsome_app.rulesimportis_some_roleclassSomeModel(RulesModel):name=models.CharField(max_length=100)classMeta:rules_permissions={'add':is_some_role,'view':is_some_role,'change':is_some_role,'delete':is_some_role,}As the last step, enable your user model to work with IAM and roles by having it inheritIAMUserMixin:# users/models.pyfromiam.mixinsimportIAMUserMixinclassUser(IAMUserMixin,...,AbstractUser):...Now only users that have aSomeRoleProfileprofile can accessSomeModel.For more examples, check outexample/blog.RationaleThis package aims to improve upon the built-in Django authorization and permissions system, by making the system fully
programmatic and not rely on database objects like the built-inGroupandPermissionmodels. We believe access
governance in applications and projects should be evident form the code, and should not rely on database states and
migrations. An instance of an app deployed on a server should not have a different access governance structure than
another instance somewhere else (which can be the case using the Django built-in authorization system).The excellent librarydjango-rulesdrastically improves upon the Django
permission system by enabling developers to create rule based systems similar to decision trees, without the need for
the database to be involved. It also allows devs to create object level permissions, something which the built-in
permission system doesn't allow.django-iambuilds ondjango-rulesby introducing the concept of Roles and Profiles. In IAM each user is assigned one
or many roles, which determine their access to certain objects or paths in the application. Each Role has an associatedProfilewhich is a database model/object with a 1-1 relationship to theUsermodel. A user has a Role if their User
account has the associated profile in an active state. Please check theQuick Setupsection for an
example on how to set IAM up in your Django project.Main toolsregistryAbstractProfileFactory (iam.factories.AbstractProfileFactory)lazy_get_predicateDeactivating profilespredicatesHasOwnerFactoryOverride permissionsOptional tools and utilities (iam.contrib)ProfileAdminAutoOwnerAdminMixinAdmin rolesAbstractIAMUserIAMUserAdminget_profile_class_verbose_name_pluralDevelopment and TestingIDE SetupAdd theexampledirectory to thePYTHONPATHin your IDE to avoid seeing import warnings in thetestsmodules. If
you are using PyCharm, this is already set up.Running the TestsInstall requirementspip install -r requirements.txtFor local environmentpytestFor all supported environmentstox