We are using django-rest-framework with django-rest-framework-jwt for authentication and it works everywhere except the django admin page at ip:port/admin/
. That still wants username and password.
Is there a setting or way to bypass that so it recognizes the JWT?
Is the /admin/
page always required to use name/password? I think the built in token auth works with it.
jwt is the only auth set in the settings.py file. Session authentication is not in there anymore.
The issue is that Django isn't aware of djangorestframework-jwt, but only djangorestframework, itself. The solution that worked for me was to create a simple middleware that leveraged the auth of djangorestframework-jwt
In settings.py:
Then in my myapp/middleware.py
Important Note: This is a naive approach that you shouldn't run in production so I only enable this middleware
if DEBUG
. If running in production, you should probably cache and lazily evaluate the user as done by the builtindjango.contrib.auth
module.The problem can be not in the authentication method you use. If you customize
User
model, it can happen thatcreate_superuser
method doesn't updateis_active
flag in user instance details toTrue
. This case django authentication backend (if you useModelBackend
) can recognize that user is not active and do not allow to authenticate. Simple check - just see what value hasis_active
field of the superuser you create. If itFalse
, update it manually toTrue
, and try to login. If it is the reason of your problem you need to overridecreate_superuser
andcreate_user
method of UserManager class.