Ask HN: How do you implement authorization in Django?

3 points by saaspirant 2y ago ↗ HN

I have just joined a startup where we build a privacy-related muli-tenant SaaS offering. We are thinking of using Django for it. Django has lot of features and libraries for authentication , 2FA etc but I can't find much on Authorisation. What do you guys use? We can't use any proprietary/closed-source solutions due to the nature of the product.

Any suggestions is appreciated?

4 comments

[ 3.2 ms ] story [ 19.2 ms ] thread

8organicbits 2y ago ↗

I think we need more info about your project and how you want authZ to work. Do you need groups? Can everyone share with anyone? Do you want to support customer defined policies, or should the service define static roles?

Oso, AuthZed, and Ory Keto come to mind, but those may be too heavyweight if you just need something basic.

rst_noimage 2y ago ↗

https://github.com/pycasbin/django-casbin

hsluoyz 2y ago ↗

The Casbin team has built a SaaS called Casdoor to provide Casbin + Django authorizations service: https://www.casdoor.com/

petr25102018 2y ago ↗

You will most likely need to build something yourself. Django's authorization is limited in this aspect :(