Re: What are the disadvantages of using a custom user model?

> Hello,
> I am evaluating whether it is better to use a custom user model in django or
> just extend django.contrib.auth.models.User.

In either case, you are still using a custom user model. The latter is
just one of the strategies to implement the former.

> The default User model offers a lot of the functionality that I don't need
> in my project and doesn't have a lot of fields that I will need.
>

Be cautious in adding fields to the user model. Convention dictates
that only data specific to authenticating the user (username,
password, etc.), or data that would be used on [almost] every single
request (first/last/given name). Other details that would fit better
within a user profile should be stored as such in a separate table
using a OneToOne field back to the custom user model. An example of
that data might be gender or age/birthday, since most requests from
that user will likely not require that information, and it should be
pulled intermittently on-demand rather than for every request/response
cycle.

> My question is, what should I be worried about when using a custom User
> model?

Assuming everything is built correctly, probably not a whole lot. The
core business logic surrounding the custom user model should match
what is currently available (creating/deleting, setting
active/inactive, etc.). Those are the touch points for 3rd party apps
(or should be, anyway). See the AbstractBaseUser class (which contains
the minimal set of fields and methods that all user models should
contain) for 1.8.4 here:

https://github.com/django/django/blob/1.8.4/django/contrib/auth/models.py#L195

All of the extra fields that most folks override live in AbstractUser,
most 'custom' user models are probably a copy of AbstractUser that has
been reworked per their requirements (but still inherits from
AbstractBaseUser).

Read the docs thoroughly (both for Django and any 3rd party apps that
may interact directly with the custom user model, which should be
relatively few), custom user models can be tricky for the more
complicated cases.

> One thing I can think of is, some plugins/apps might require django's
> built-in User model to function properly.

If you find an app that requires the use of the built-in User model,
you probably shouldn't use it. Django has had support for custom user
models since 1.5, which was quite a while ago, and plenty of time for
3rd party apps to catch up.

> Any other issues I should be aware of?
>

If you create a custom authentication backend in addition to your
custom user model, you may run into trouble with other apps that may
expect certain things to be there (same rules apply here as to custom
user models). If all you are doing is adding or suppressing fields in
your custom user model without modifying the authentication backend,
then you should be fine. You may be required to provide a custom auth
backend if your custom user model is something more than a couple of
extra fields.

The authentication backend does have a few "required" behaviors, but
that is all listed in the docs if you are so inclined.

Any decent apps with that deep of a dependency will likely provide a
disclaimer that specific functionality is expected on the user model
or authentication backend. Unless you go way off the reservation,
though, you should be fine.

TL;DR; The large majority of 3rd party apps won't care or even know
that you are using a custom user model, as long as it is implemented
correctly.

-James

--
You received this message because you are subscribed to the Google Groups "Django users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to django-users+unsubscribe@googlegroups.com.
To post to this group, send email to django-users@googlegroups.com.
Visit this group at http://groups.google.com/group/django-users.
To view this discussion on the web visit https://groups.google.com/d/msgid/django-users/CA%2Be%2BciVHYyfi07-g0g7z5%3Dr5%3D%3D%2BtY9Omd0dErrdap0hm3j1kRA%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.