For inactive user, `JSONWebTokenSerializer.validate()` raises `Unable to login with provided credentials.`

[ibrahim12]

For inactive user, JSONWebTokenSerializer.validate() raises Unable to login with provided credentials.

Django Version 1.10.5

Django Model Backend's authenticate method checks as follows,

if user.check_password(password) and self.user_can_authenticate(user):
    return user

And user_can_authenticate method is

 def user_can_authenticate(self, user):
        """
        Reject users with is_active=False. Custom user models that don't have
        that attribute are allowed.
        """
       is_active = getattr(user, 'is_active', None)
       return is_active or is_active is None

So, If user is inactive then, in JSONWebTokenSerializers.validate method returns wrong response as it don't goes to that block of code as user is None.

  if user: <- This is None, for inactive user.
        if not user.is_active:
               msg = _('User account is disabled.')
               raise serializers.ValidationError(msg)

         payload = jwt_payload_handler(user)

         return {
               'token': jwt_encode_handler(payload),
               'user': user
         }
   else:
          msg = _('Unable to login with provided credentials.')
          raise serializers.ValidationError(msg)

[RubenSchmidt]

Is this not related to the Django 1.10 change for the ModelBackend? Inactive users are not allowed to authenticate by default any more. You have to use AllowAllUsersModelBackend (https://docs.djangoproject.com/en/1.10/ref/contrib/auth/#django.contrib.auth.backends.AllowAllUsersModelBackend) To allow inactive users to authenticate.

[igsm]

I face the same issue. I still do NOT want to authenticate inactive user, however, I'd like to differentiate the error response. It always throws 'wrong credentials' error. How can I solve this problem?

[manan]

this would help me a lot too

[mrtysn]

I am also looking for a workaround for this problem. Is overriding the VerifyJSONWebTokenSerializer a good idea?

[jeanmw]

Also waiting for a resolution to this issue.