The User model acts as the central component within the Django authentication framework, serving as the primary representation of individuals interacting with the application. This model facilitates access control, profile management, and content ownership. In Django's architecture, there is no distinction in class hierarchy between standard users, administrators (staff), or superusers; instead, these roles are differentiated solely by specific boolean flags such as is_staff or is_superuser.

Generating New Accounts

To programmatically create a standard user, the create_user() helper method provided by the user model manager is the standard approach. This method handles password hashing automatically.

from django.contrib.auth.models import User

# Create a new user with a username, email, and password
new_account = User.objects.create_user(
    username='alice',
    email='alice@example.com',
    password='secure_password_123'
)

Establishing Superuser Privileges

Creating an account with full administrative access is typically handled via the command line interface using the createsuperuser management command. This process prompts for necessary credentials interactively.

# Execute the command to initiate the creation process
$ python manage.py createsuperuser

# Alternatively, provide arguments non-interactively
$ python manage.py createsuperuser --username=admin --email=admin@example.com

Modifying User Credentials

Updating a user's password requires retrieving the user instance, utilizing the set_password() method to handle the hashing of the new plaintext password, and then saving the object. Direct assignment to the password attribute is discouraged as it bypasses hashing logic.

from django.contrib.auth.models import User

# Retrieve the target user account
account = User.objects.get(username='alice')

# Update the password and persist changes
account.set_password('new_secure_pass')
account.save()

Verifying User Identity

The authenticate() function is responsible for verifying credentials against the database. It accepts keyword arguments—typically username and password—and returns the corresponding User object if the credentials are valid. If the password is incorrect or the user does not exist, the function returns None.

from django.contrib.auth import authenticate

def verify_login(request):
    # Validate the provided credentials
    user = authenticate(request, username='alice', password='new_secure_pass')

    if user is not None:
        # Check if the account is currently active
        if user.is_active:
            print("Authentication successful: Account is active.")
        else:
            print("Authentication successful: Account is disabled.")
    else:
        # Credentials were invalid
        print("Authentication failed: Invalid username or password.")

    return user