[Answered ]-User managment django-tastypie (angular)

1

But I have some problems and questions: Firstly I can sign in with the
superuser account, but i only get {“success”:true,”$resolved”:true} as
respons… should i not get some sort of token or id or more data?

What you do in login is assigning request with user. You authenticated user here: user = authenticate(username=username, password=password) and assigned that user to request here: login(request, user). So Django will now recognize request.user as that user during your session.

You haven’t defined authentication method in your resource therefore is default. It gives access to anonymous users also so don’t have to be even authenticated to have access. Once your decide which authentication you want to use then you will think about tokens and stuff.
See this: Authentication in Tastypie

2

Secoundly i can signup new users, but they can NOT sign in as i get:
401 (UNAUTHORIZED)

Your are seeing this most likely because your password or username is incorrect. user = authenticate(username=username, password=password) gives you user is None and your eles block is executed. You can make sure with printing logs in that step.

3

Edit: upon further investigation i notised that although I can sign up
new users, thay do not get any password set… why is this?

I tested the same code and works perfectly. Make sure you don’t have typo on frontend side. And print logs with values in obj_create to make sure they aren’t empty.

4

To allow session authentication is quite difficult and it is capable for another question. This make it possible to get request.user. (Very insecure but simple)

class PasswordAuthentication(Authentication):
    def is_authenticated(self, request, **kwargs):
        """
        Allow get not authenticated users but try assign user to request
        if possible.
        """
        try:
            username, password = request.GET.get('username'), request.GET.get('password')
        except ValueError:
            return True

        if not username or not password:
            return True

        try:
            user = User.objects.get(username=username, password=password)
        except (User.DoesNotExist, User.MultipleObjectsReturned):
            return True

        if not self.check_active(user):
            return True

        request.user = user

        return True


class UserResource(ModelResource):
    class Meta:
        queryset = User.objects.all()
        resource_name = 'user'
        excludes = ['email', 'password', 'is_active', 'is_staff', 'is_superuser'] 
        serializer = Serializer(formats=['json', 'jsonp'])
        authentication = PasswordAuthentication()
        always_return_data = True
        filtering = {
            'username': 'exact',
            'id': ALL_WITH_RELATIONS,
        }

    [...]

    def logout(self, request, **kwargs):
        self.method_check(request, allowed=['get'])
        if request.user and request.user.is_authenticated():
            logout(request)
            return self.create_response(request, { 'success': True })
        else:
            return self.create_response(request, { 'success': False }, HttpUnauthorized)

call backend with http://xx.xxx.xxx.xx:xxxx/api/v1/user/logout/4/?username=asdf&password=1234