---
title: "Conas fíordheimhniú ag baint úsáide as REMOTE_USER"
version: 6.0
locale: ga
source: https://docs.djangoproject.com/ga/6.0/howto/auth-remote-user/
canonical: https://djangodocs.dev/ga/6.0/howto/auth-remote-user/
---
# Conas fíordheimhniú ag baint úsáide as `REMOTE_USER`

This document describes how to make use of external authentication sources in
your Django applications. This type of authentication solution is typically
seen on intranet sites, with single sign-on solutions such as IIS and
Integrated Windows Authentication or Apache and [mod\_authnz\_ldap](https://httpd.apache.org/docs/current/mod/mod_authnz_ldap.html), [CAS](https://www.apereo.org/projects/cas),
[WebAuth](https://uit.stanford.edu/service/authentication), [mod\_auth\_sspi](https://sourceforge.net/projects/mod-auth-sspi), etc.

When the web server takes care of authentication it typically provides the
authenticated user as `REMOTE_USER`. In Django, this value is made available
in [`request.META`](/ga/6.0/ref/request-response/#django.http.HttpRequest.META) (as `REMOTE_USER` when
supplied as an environment variable, as in WSGI, or `HTTP_REMOTE_USER` when
supplied via an HTTP header, as in ASGI). Django can be configured to make use
of the `REMOTE_USER` value using the `RemoteUserMiddleware` or
`PersistentRemoteUserMiddleware`, and
[`RemoteUserBackend`](/ga/6.0/ref/contrib/auth/#django.contrib.auth.backends.RemoteUserBackend) classes found in
[`django.contrib.auth`](/ga/6.0/topics/auth/#module-django.contrib.auth).

## Cumraíocht

Ar dtús, ní mór duit an:class: django.contrib.auth.middleware.remoteUserMiddleware a chur leis an socrú:setting: MIDDLEWARE tar éis \*\* an:class: django.contrib.auth.middleware.AuthenticationMiddleware:

```
MIDDLEWARE = [
    "...",
    "django.contrib.auth.middleware.AuthenticationMiddleware",
    "django.contrib.auth.middleware.RemoteUserMiddleware",
    "...",
]
```

Ansin, ní mór duit:class: ~django.contrib.auth.backends.modelBackend a chur in ionad la:class: ~django.contrib.auth.backends.remoteUserBackend sa socrú: AUTHENTICATION\_BACKENDS:

```
AUTHENTICATION_BACKENDS = [
    "django.contrib.auth.backends.RemoteUserBackend",
]
```

With this setup, `RemoteUserMiddleware` will detect the username in
`request.META['REMOTE_USER']` (or `request.META['HTTP_REMOTE_USER']` under
ASGI) and will authenticate and auto-login that user
using the [`RemoteUserBackend`](/ga/6.0/ref/contrib/auth/#django.contrib.auth.backends.RemoteUserBackend).

Bí ar an eolas go ndíchumasaíonn an socrú áirithe seo fíordheimhniú leis an réamhshocraithe `ModelBackend`. Ciallaíonn sé seo mura socraítear an luach REMOTE\_USER\` ansin níl an t-úsáideoir in ann logáil isteach, fiú ag baint úsáide as comhéadan riaracháin Django. Ag cur `` `Django.contrib.auth.backends.ModelBackend' `` leis an liosta `AUTHENTICATION_BACKENDS`, úsáidfear `ModelBackend` mar fhillback má tá `REMOTE_USER` as láthair, rud a réiteoidh na saincheisteanna seo.

Ní chomhtháthaíonn bainistíocht úsáideora Django, mar shampla na tuairimí i contrib.admin \`\`agus an t-ordú bainistíochta: djadmin: \`createsuperuser, le húsáideoirí iargúlta. Oibríonn na comhéadain seo le húsáideoirí atá stóráilte sa bhunachar sonraí beag beann ar AUTHENTICATION\_BACKENDS\`.

> **Note**
>
> Ós rud é go dtagann an RemoteUserBackend\` oidhreacht ó `ModelBackend`, beidh na ceadanna céanna go léir agat fós a chuirtear i bhfeidhm i `ModelBackend`.
>
> \<django.contrib.auth.models.User.is\_active\>Ní cheadfar d'úsáideoirí le:attr: is\_active=false \`fíordheimhniú. Úsáid:class: \`~django.contrib.auth.backends.allowAllUsersRemoteUserBackend más mian leat ligean dóibh.

If your authentication mechanism uses a custom HTTP header and not
`REMOTE_USER`, you can subclass `RemoteUserMiddleware` and set the
`header` attribute to the desired `request.META` key. For example:

*`mysite/middleware.py`*

```python
 from django.contrib.auth.middleware import RemoteUserMiddleware

 class CustomHeaderRemoteUserMiddleware(RemoteUserMiddleware):
     header = "HTTP_AUTHUSER"
```

This custom middleware is then used in the [`MIDDLEWARE`](/ga/6.0/ref/settings/#std-setting-MIDDLEWARE) setting
instead of [`django.contrib.auth.middleware.RemoteUserMiddleware`](/ga/6.0/ref/middleware/#django.contrib.auth.middleware.RemoteUserMiddleware):

```
MIDDLEWARE = [
    "...",
    "django.contrib.auth.middleware.AuthenticationMiddleware",
    "mysite.middleware.CustomHeaderRemoteUserMiddleware",
    "...",
]
```

> **Warning**
>
> `RemoteUserMiddleware` must not be deployed in configurations where a
> client can supply the header. You must be sure that your web server or
> reverse proxy always sets or strips that header based on the appropriate
> authentication checks, never permitting an end user to submit a fake (or
> "spoofed") header value.
>
> Since the HTTP headers `X-Auth-User` and `X-Auth_User` (for example)
> both normalize to the `HTTP_X_AUTH_USER` key in `request.META`, you
> must also check that your web server doesn't allow a spoofed header using
> underscores in place of dashes.
>
> Under WSGI, this warning doesn't apply to `RemoteUserMiddleware` in its
> default configuration with `header = "REMOTE_USER"`, since a key that
> doesn't start with `HTTP_` in `request.META` can only be set by your
> WSGI server, not directly from an HTTP request header.
>
> This warning applies under ASGI in all configurations, because there is
> no equivalent for a WSGI server's ability to place a trusted value in the
> environ. ASGI deployments *must* use a reverse proxy as described above
> when using this middleware.

Má theastaíonn níos mó smachta uait, is féidir leat do chúltaca fíordheimhnithe féin a chruthú a fhaigheann oidhreacht ó:class: ~django.contrib.auth.backends.remoteUserBackend agus ceann amháin nó níos mó dá thréithe agus modhanna a shárú.

## Ag baint úsáide as `REMOTE_USER` ar leathanaigh logála isteach amháin

Glacann an middleware fíordheimhnithe `RemoteUserMiddleware` go bhfuil an ceannteideal iarratais HTTP `REMOTE_USER` i láthair le gach iarratas fíordheimhnithe. D'fhéadfaí súil leis sin agus praiticiúil nuair a úsáidtear Basic HTTP Auth le htpasswd nó meicníochtaí den chineál céanna, ach le Negoate (GSSAPI/KerberOS) nó modhanna fíordheimhnithe dian-acmhainní eile, de ghnáth ní bhunaítear an fíordheimhniú sa bhfreastalaí HTTP tosaigh ach le haghaidh URL amháin nó cúpla URL, agus tar éis fíordheimhniú rathúil, ceaptar an feidhmchlár an seisiún fíordheimhnithe féin a choinneáil.

[`PersistentRemoteUserMiddleware`](/ga/6.0/ref/middleware/#django.contrib.auth.middleware.PersistentRemoteUserMiddleware)
provides support for this use case. It will maintain the authenticated session
until explicit logout by the user. The class can be used as a drop-in
replacement of [`RemoteUserMiddleware`](/ga/6.0/ref/middleware/#django.contrib.auth.middleware.RemoteUserMiddleware)
in the documentation above.