Skip to main content

Users and access

Added in 1.0.1

Chassis ships a users module that extends stock Django Admin: Users, Groups, admin sessions, login-attempt limits, the administrator profile, self password change, GeoIP country detection, and the Admin action journal.

It does not include product roles, MFA, or OIDC. Those stay in the application.

What the site enables​

When include_users_module = True (the default), ChassisAdminSiteMixin:

  • registers Chassis UserAdmin / GroupAdmin for AUTH_USER_MODEL and Group
  • registers UserSession, LoginAttempt, LoginAttemptSchedule, AdminAuditLog
  • adds the personal Profile and Change password pages
  • adds matching user-menu items
  • prepends the Users and groups sidebar section
  • uses ChassisAdminAuthenticationForm when login_form is unset
  • shows a GeoIP dashboard alert to superusers when the Country database is missing

Turn the module off on a site that must stay empty:

class CustomAdminSite(ChassisAdminSiteMixin, AdminSite):
    include_users_module = False

Keep the admins and pages but declare your own sidebar:

class CustomAdminSite(ChassisAdminSiteMixin, AdminSite):
    include_users_sidebar = False
    sidebar_items = (
        # your sections, including auth.user / auth.group if you want them
    )

The default section is the stock Django “Users and groups” list plus Chassis access models. Product roles are not added:

  • auth.User
  • auth.Group
  • django_chassis.UserSession
  • django_chassis.LoginAttemptSchedule
  • django_chassis.LoginAttempt
  • django_chassis.AdminAuditLog

Override get_users_sidebar_section() if you need a different label or order.

The session changelist shows active sessions by default and provides explicit Inactive and All states. Its terminate action is available only for an active, non-current session when the administrator has the matching permission.

Middleware​

Add the session registry and Admin journal after authentication:

MIDDLEWARE = [
    # ...
    'django.contrib.auth.middleware.AuthenticationMiddleware',
    'django_chassis.middlewares.UserSessionMiddleware',
    'django_chassis.middlewares.AdminAuditMiddleware',
]

Session and Admin audit rows store client IP via netaddr and browser/OS via device-detector (User-Agent plus Chromium Client Hints).

Both middlewares listen on CHASSIS_ADMIN_PATH_PREFIX (default /admin/).

UserSessionMiddleware registers the current staff session, refreshes last-seen at most once a minute, and logs the user out if the registry row is revoked or expired.

Database tables​

Changed in 1.0.1

The users module stores its data in chassis_user_profiles, chassis_user_sessions, chassis_login_attempt_schedules, chassis_login_attempts, and chassis_admin_audit_logs.

Settings​

SettingDefaultPurpose
CHASSIS_LOGIN_ATTEMPT_LIMITS_ENABLEDTrueApply LoginAttemptSchedule delays
CHASSIS_ADMIN_PATH_PREFIX'/admin/'Path prefix for session and audit middleware
GEOIP_COUNTRY_DATABASE_PATHunsetAbsolute path to GeoLite2 Country .mmdb

An empty login-attempt schedule means no delays. Configure rows in Admin (first position must have delay_seconds=0).

GeoIP​

Changed in 1.0.1

geoip2 ships with the package. Point Django at a MaxMind Country file:

GEOIP_COUNTRY_DATABASE_PATH = '/var/lib/geoip/GeoLite2-Country.mmdb'

If the path or file is missing, country codes stay empty. Trusted proxy headers (CF-IPCountry, X-Country-Code, X-Geo-Country) are read only when the database file is available.

Profile and password​

AdminProfileAdminPage is a PersonalAdminPage: the current staff user sees account data, groups, last login/IP/country, the current session, and a timeline of their Admin audit rows. There is no MFA or product-role block.

SelfPasswordChangeAdminPage uses Django’s PasswordChangeForm (old password required), then logs the user out.

See also​