Django Packages : Permissions

Permissions

A grid of all packages implementing permissions for users and groups in your Django project.

Please fell free to verify and update features for listed apps or add another app if you know one.

Features currently being evaluated

Feature	Description
Object-level	Support for permissions assigned per object.
Django 1.2 backend	See: http://docs.djangoproject.com/en/dev/releases/1.2/#object-level-permissions .
Decorator	Object-level decorator for views.
Logical checks	Support for permission checked dynamically, e.g. can view entry no older than one month.
Database	Is a database required? If not, how are permissions stored?
Declaration	Do you declare permissions for models? How?
Assignment	How do you assign permissions for objects?
Templatetag	Permissions checks in templates via tags.
Inheritance	Permissions inheritance from related objects.
Roles	Support for roles in permissions.
Field level	Supports permissions at the field level of models
Cascade update	Support for cascade update of related objects, e.g. if added view or change perm for the product, then add view perm for the product category.
Any-to-any	Permissions for any object to any other object.
Model-level	Support for model-level perms (either on its own or by seamless integration with django.contrib.auth permissions).

Package	django-guardian	rules	drf-extensions	django-oso	django-role-permissions	dry-rest-permissions	djangorestframework-api-key	django-permission	DRF Access Policy	django-authority	django-admin-view-permission	django-rules	django-prbac	django-objectpermissions	django-rbac	django-rulez	Django-Access	Tabular Permissions Widget	carteblanche	django-permissionsx	django-global-permissions	django-extauth	drf-psq	Django Debug Permissions	django-hats	django-hierarchical-auth	django-field-permissions	django-permission-backend-nonrel	django-improved-permissions	django-trusts	django-permissions	django-finegrained-permissions	django-permissions-auditor	serious-django-permissions	giaola-role-permissions	django-auth-utils	restframework-serializer-permissions	django-rubberstamp	Django Permafrost	django_sieve	django-acl	django-acl	django-generic-permissions	Django Object Permissions	django-http-451	django-flexible-permissions	django-custodian	django-simple-perms	django-pobject	django-bop	django-roles

Package	django-guardian	rules	drf-extensions	django-oso	django-role-permissions	dry-rest-permissions	djangorestframework-api-key	django-permission	DRF Access Policy	django-authority	django-admin-view-permission	django-rules	django-prbac	django-objectpermissions	django-rbac	django-rulez	Django-Access	Tabular Permissions Widget	carteblanche	django-permissionsx	django-global-permissions	django-extauth	drf-psq	Django Debug Permissions	django-hats	django-hierarchical-auth	django-field-permissions	django-permission-backend-nonrel	django-improved-permissions	django-trusts	django-permissions	django-finegrained-permissions	django-permissions-auditor	serious-django-permissions	giaola-role-permissions	django-auth-utils	restframework-serializer-permissions	django-rubberstamp	Django Permafrost	django_sieve	django-acl	django-acl	django-generic-permissions	Django Object Permissions	django-http-451	django-flexible-permissions	django-custodian	django-simple-perms	django-pobject	django-bop	django-roles
Description	Per object permissions for Django	Awesome Django authorization, without the database	DRF-extensions is a collection of custom extensions for Django REST Framework	Oso is a batteries-included library for building authorization in your application.	A django app for role based permissions.	Rules based permissions for the Django Rest Framework	🔐 API key permissions for Django REST Framework	[Not maintained] An enhanced permission system which support object permission in Django	Declarative access policies/permissions modeled after AWS' IAM policies.	A Django app that provides generic per-object-permissions for Django's auth app and helpers to create custom permission checks.	Reusable application which provides a view permission for the existing models.	Flexible and scalable Django authorization backend for unified per object permission management		An app to add object-level/row-level permissions to users and groups. Each model can have different permissions.	Role-based Access Control (RBAC) implementation for management of permissions in Django. Allows a fine-grained (row level) permission assignment. Perfect fo...	A lean and mean object-level rules system for the Django framework	Django-Access - the application introducing dynamic evaluation-based instance-level (row-level) access rights control for Django	Display Django permissions in a HTML table that is translatable and easily customized.	Module to align code with thoughts of users and designers. Also magically handles navigation and permissio...	PermissionsX - Authorization for Django	Global permissions for Django	Extended authorization framework for Django, including field-level permissions and role-based permissions	The simplest and most general way to manage action-based permissions, serializers, and querysets dependent on permission-based rules for the Djang...	Get a list of all user permissions available in the system	Role-based permissions system for Django. Everyone wears a different hat, some people wear multiple.	Extends django auth allowing hierarchical permissions	A starting place for field-level permissions	An authentication backend that supports Django's user and group permissions on Django-nonrel	Django application made to make django's default permission system more robu...	Django authorization add-on for multiple organizations and object-level permission settings		Permissions per field instead of per model for django	Tool to audit access control on your django app.	A Django extension to define and use Groups and Permissions from a central place, per app.	A django app for role based permissions.	Django authentication and authorization utilities	Drop in replacement for Django Restframework Serializers to add permission based field serialization.	Permissions manager and backend for Django 1.2, supporting object permissions and application-specific permissions.	Adds User Definable Permissions to Django	Serve user-wise data beautifully, minimally and correctly.	Access Control Lists for django aka per-row permissions. Largely inspired on phpBB's ACL. Support for roles.		A simple Authentication Backend to manage specific permissions.	This is an implementation of Object Permissions, a.k.a. row level permissions. Object Permissions allow you to assign a permission t...	Django implementation for HTTP451	A Django app that combines object-level table permissions with model relations to avoid normalization of data while providing an extremel...	The application django-custodian wrap and extend django.contrib.auth module providing a exaustive and granular approach to authorizations and permissions management. I...		An expressive and concise mini permission module for Django views.	Basic Object-level Permissions for django 1.2+	Django Roles with Role-Group-Permission-User
Category	App	App	App	App	App	App	App	Framework	Other	App	App	App	App	App	App	App	App	App	Other	App	App	App	App	App	App	App	App	App	App	App	Framework	Other	App	App	Other	App	Other	App	App	App	App	App	App	App	App	App	App	App	Other	App	App
# Using This	76	19	6	2	6	2	0	3	0	3	3	3	0	0	0	6	2	1	1	1	0	0	0	0	1	1	0	3	2	1	5	0	0	0	1	1	0	0	0	0	0	0	1	0	0	2	0	1	1	0	1
Python 3?
Development Status	Production/Stable	Production/Stable	Production/Stable	Beta	Production/Stable	Production/Stable	Beta	Production/Stable	Unknown	Production/Stable	Production/Stable	n/a	Alpha	Unknown	Beta	Unknown	Beta	Production/Stable	Unknown	Production/Stable	Pre-Alpha	n/a	Unknown	Beta	Production/Stable	Unknown	n/a	n/a	Unknown	Beta	Production/Stable	Beta	Production/Stable	Unknown	Production/Stable	Alpha	Unknown	n/a	Alpha	Pre-Alpha	n/a	Unknown	Production/Stable	Unknown	Unknown	Unknown	n/a	Unknown	n/a	Beta	Unknown
Last updated	June 2, 2021, 10:44 a.m.	May 23, 2021, 7:56 a.m.	Aug. 2, 2021, 1:34 a.m.	Aug. 4, 2021, 4:15 p.m.	Jan. 4, 2021, 10:54 a.m.	Jan. 31, 2018, 9:27 a.m.	April 20, 2021, 8:14 p.m.	March 4, 2020, 5:19 a.m.	July 9, 2021, 1:03 a.m.	Nov. 26, 2020, 10:31 a.m.	Dec. 2, 2018, 4:45 p.m.	July 16, 2011, 11:32 a.m.	Jan. 18, 2021, 2:15 p.m.	Oct. 8, 2010, 7:23 a.m.	March 31, 2010, 11:04 p.m.	Jan. 13, 2018, 2:04 p.m.	April 22, 2020, 3:22 a.m.	Sept. 15, 2020, 7:04 a.m.	July 3, 2014, 11:51 a.m.	Nov. 3, 2017, 8:01 p.m.	Oct. 10, 2018, 1:11 p.m.	Dec. 10, 2011, 8:42 p.m.	Feb. 26, 2021, 12:51 p.m.	May 14, 2020, 3:56 a.m.	July 22, 2019, 9:57 a.m.	Jan. 5, 2011, 3:03 p.m.	May 1, 2016, 3:25 a.m.	April 9, 2011, 4:27 p.m.	Nov. 27, 2018, 5:56 a.m.	April 30, 2016, 3:17 a.m.	June 21, 2015, 12:25 p.m.	Oct. 6, 2013, 2:36 p.m.	May 20, 2021, 4:11 p.m.	June 19, 2021, 11:36 a.m.	Aug. 28, 2018, 5:42 a.m.	Nov. 15, 2017, 5:47 a.m.	April 6, 2021, 9:24 a.m.	Oct. 28, 2010, 6:27 p.m.	April 16, 2021, 12:57 p.m.	June 4, 2014, 3:59 p.m.	Aug. 23, 2009, 4:17 p.m.	Oct. 8, 2015, 7:49 p.m.	Jan. 9, 2013, 10:47 p.m.	June 6, 2013, 6:33 p.m.	Nov. 3, 2018, 5:13 a.m.	Dec. 10, 2015, 9:21 p.m.	Nov. 10, 2011, 7:31 p.m.	Jan. 10, 2019, 3:22 p.m.	March 4, 2011, 11:24 a.m.	Oct. 20, 2011, 9:16 a.m.	Jan. 28, 2015, 4:04 p.m.
Version	2.4.0	3.0	0.7.1	0.10.0	3.1.1	0.1.10	2.0.0	1.0.5	1.0.1	0.14	1.9	n/a	1.0.1	0.3.3	0.9	1.0.2	n/a	2.8	1.0.0	2.0.0	0.2.4	n/a	1.1.0	1.0.0	1.1.2	1.4.6	n/a	n/a	0.2.2	0.10.3	1.2.2	0.0.1	1.0.4	0.17	1.2.0	0.1.1	0.0.2	n/a	0.2.15	1.0.0	n/a	0.1.3	0.1.0	1.4.6	0.1	1.0.7	n/a	0.2.8	n/a	0.3	0.0.4
Repo	Github	Github	Github	Github	Github	Github	Github	Github	Github	Github	Github	Github	Github	Github	Bitbucket	Github	Github	Github	Github	Github	Github	Bitbucket	Github	Github	Github	Github	Github	Bitbucket	Github	Github	Github	Github	Github	Github	Github	Github	Github	Github	Github	Github	Bitbucket	Github	Github	Github	Github	Github	Bitbucket	Bitbucket	Bitbucket	Github	Github
Commits
Stars	3003	1339	1193	1189	483	361	352	304	255	237	152	147	106	87	65	63	52	47	42	39	28	21	21	21	21	20	19	16	15	13	13	11	10	8	8	7	7	7	6	6	5	5	4	4	3	3	3	2	2	2	2
Repo Forks	515	103	196	52	102	60	52	46	26	53	42	11	35	10	4	17	2	8	2	4	8	2	3	1	n/a	6	16	n/a	2	2	11	2	1	n/a	1	n/a	n/a	n/a	1	1	2	1	1	2	1	1	n/a	n/a	n/a	n/a	n/a
Participants	lukaszb brianmay ad-m michael-k bsvetchine johnthagen mitar ggreer troygrosfield xordoquy more...	dfunckt zerolab dyve efficiosoft ticosax mlsen thedrow orf pjsier danlamanna more...	auvipy chibisov pratyushmittal rpkilby OskarPersson maryokhin alexander-akhmetov codingjoe joehybird tuky more...	saolsen dhatch gj samscott89 leina05 plotnick samraper gw000 gkaemmer joshrotenberg more...	filipeximenes powderflask kavdev fjsj iurisilvio reduxionist amandasavluchinske andersonresende victorgutemberg aarcro more...	dbkaplan AlexandreCollet mbaragiola ttill wernerhp abeniwal GerardPaligot marctc vovanbo artragis	florimondmanca spaceofmiah biancaG guilleijo jaswanthm jeancochrane jeffgodwyll tony UtkucanBykl	lambdalisue giginet quasiyoke LuRsT argsno oskarjakiela philippeowagner Simanas timgates42 AmbientLighter more...	rsinger86 dependabot[bot] BarnabasSzabolcs oguzhancelikarslan tanonl HonakerM JamesonNetworks daviddavis JT501 greenled more...	jezdez jlward bartTC winhamwr bocribbz gthb safwanrahman remik diegobz RDIL more...	lefterisnik Anton-Shutik awgreenblatt michi88 pieterdd ciarancourtney kapucko lanterno crazyscientist pinerojuancruz more...	maraujop jjmaestro	millerdev kennknowles czue dannyroberts biyeun GertBurger NoahCarnahan ArtemBernatskyy nickpell snopoke more...	justquick jazzido bhuztez	nabucosound	chrisglass maraujop jjmaestro stefanfoulis nigma juandecarrion mitchellrj amites bashu DanLipsitt more...	nnseva	RamezIssac ihabhussein abahnihi vintage	neuman lightstrike	robpogorzelski adi-	eduardo-matos perdy	mhall119	AminHP salarnasiri zshongyi	timonweb	miketheredherring	rasca	tiliv	fhahn	gabrielbiasi	thomasyip core2duo suhailvs	diefenbach	specialunderwear PetrDlouhy	kluchrj LerikG	LilithWittmann seblat	filipeximenes g20ready dimkl reduxionist fjsj andersonresende victorgutemberg aarcro jamespenick myonov more...	PiDelport	manfred-kaiser	paltman	devo-wm renderbox mgcamisa jared-hardy		tyrion		garrypolley	bramwelt MostAwesomeDude bsu Kennric chancez		staab	fabiomichelini	hespul	phuihock	pterk	cenkbircanoglu
Documentation		N/A							N/A			N/A	N/A	N/A	N/A	N/A			N/A		N/A		N/A	N/A		N/A	N/A	N/A	N/A			N/A		N/A		N/A	N/A	N/A	N/A		N/A		N/A	N/A	N/A		N/A		N/A
Object-level																									, In conjunction with django-guardian since `Groups` can be used.					✅ ✅ django-trusts always works as an annexation; all features require no patched class of any sort, works with all existing builtin auth features: authorization, permission, group, contenttypes; option to use junction table mechanism: no moditication to any existing model.
Django 1.2 backend
Decorator								Works as class/method/functional decorator.												This package operates on view level.										Implemented: @permission_required('app.read_project', fieldlookups_kwargs={'pk': 'project_id'})													django.contrib.auth.decorators.permission_required
Logical checks				Using the Polar policy language				each model have PermissionHandler for them and has_perm method will be called for paricular model.																						via lambda registered with model (i.e., Content.register_permission_condition(Receipt, 'own', lambda u, p, o: u == o.user)) @permission_required('app.change_receipt:own', fieldlookups_kwargs={'pk': 'pk'})																No, though it's extensible enough to add that easily.
Database		registry of callables		Logic is written as .polar policy files				it use 'Logic' based permission system which is completely different from general permission system.																						implementation optimized to reduce db hits per http request																		only logical check
Declaration		registry of callables		Using the policy language	permissions are defined by role.			registration. Each model can be registered with Handler for them		, permission classes				, registration		as a method in the same model				Permissions are declared for views.					, Role class inheritance				, using the same method as auth Django system.	via django's permission model: app.change_xyz, app.add_xyz, app.delete_xyz or any custom permissions													permissions are view and function level permissions	, registration dynamically creates permission models		Yes, by creating a role-agent-entity entry, combined with checking optional model relations.	, global permissions in settings and model permission as canonical auth	, declaration in a perms.py file in app
Assignment	manager + patched User and Group + shortcut function + Admin Integration (with ModelAdmin extension)	irrelevant			, utils functions			Add builtin PermissionLogic subclass or your own PermissionLogic subclass to the target model class.		permission classes instances + admin (action) + custom views				patched User and Group	manager	In the same model as a method which takes the User as argument and returns True or False				Permissions are not assigned to models.									using shortcuts functions and mixins for Users and Objects	via Models or Django Admin UI (upcoming: REST api via tastypie)	utils functions										utils functions		use the provided add_permission backend from django_generic_permissions.backends import add_permission add_permission('foo', logged_in_user)	patched User and Group or util functions		By creating a Permission record, mapping actions to roles, and defining permission inheritance via relations.	, complete API and GUI	logical only (code executed on object to determine permission)
Templatetag								You can use like {% if user has 'auth.change_user' of object %}								not needed as it is integrated with django.contrib.auth permissions													, has_perm	supports django's builtins														, limited functionality
Inheritance		irrelevant		By writing simple rules				for PermissionLogic class																					, full inheritance defining the "parents" of the model.	Can be achieve with two methods: a) by register the model with field lookup path from another permissible model (i.e., Content.register_content(ReceiptImage, '%s__image' % Content.get_content_fieldlookup('app.Receipt')), or b) by sharing the same `trust` between depended / dependent objects																	, from parent container
Roles		irrelevant		Check documentation for examples				if you add a PermissionLogic class like http://bit.ly/1z22IGl																					, is actually required to have roles.	Role is specified in model's meta and management commands updates db entires and makes it available for permission check																	, assimilated by groups
Field level					, define it in a object level checker.															Objects are assigned to request and they can be compared to other values by attributes or methods.										?
Cascade update		irrelevant		Permissions are dynamic				Can be												Depends on implementation.									, the inheritance system also handle this behavior.	supports updating of multiple object permissions via `trust` and multiple users via django's `auth.models.Group`
Any-to-any								Can be																					, only User-to-any	Same mechanism as Inheritance
Model-level										, integration					, own	integrated with django.contrib.auth permissions													, using role classes with models=ALL_MODELS	design to be used alongside with Django's builtin auth ModelBackend											, own		this works independent of Django models intentionally				, own and integrated