Groups and Roles0%
Groups and Roles
Beginner12 min read•Updated: Jul 11, 2026
Groups and Roles
Assigning individual permissions to hundreds of separate users creates administrative chaos. In enterprise architectures, permissions are organized into Groups representing functional business roles (e.g. Editorial Staff, Billing Managers, Support Agents, Compliance Officers). Users inherit all permissions assigned to their groups, enabling centralized, role-based access management.
1. Groups and Role Architecture
Output
Individual Users:
[ Alice (Lead Editor) ] ──┐
├──► Assigned to Group: "Editors"
[ Bob (Staff Writer) ] ──┘ │
▼
Granted Permissions:
- articles.add_article
- articles.change_article
- articles.view_article
2. Programmatically Managing Groups and Permissions
You can configure groups and permissions via Django data migrations or management scripts:
Python
# accounts/management/commands/setup_roles.py
from django.core.management.base import BaseCommand
from django.contrib.auth.models import Group, Permission
from django.contrib.contenttypes.models import ContentType
from articles.models import Article
class Command(BaseCommand):
help = "Seeds standard enterprise groups and permissions"
def handle(self, *args, **options):
# 1. Create or retrieve Groups
editors_group, _ = Group.objects.get_or_create(name="Editors")
viewers_group, _ = Group.objects.get_or_create(name="Viewers")
# 2. Lookup ContentType for Article model
article_content_type = ContentType.objects.get_for_model(Article)
# 3. Retrieve specific permissions
can_add = Permission.objects.get(content_type=article_content_type, codename="add_article")
can_change = Permission.objects.get(content_type=article_content_type, codename="change_article")
can_view = Permission.objects.get(content_type=article_content_type, codename="view_article")
# 4. Assign permissions to Groups
editors_group.permissions.set([can_add, can_change, can_view])
viewers_group.permissions.set([can_view])
self.stdout.write(self.style.SUCCESS("Roles successfully configured!"))
3. Assigning Users to Groups
Python
from django.contrib.auth.models import Group
from django.contrib.auth import get_user_model
User = get_user_model()
user = User.objects.get(email="alice@enterprise.com")
# Assign user to group
editors_group = Group.objects.get(name="Editors")
user.groups.add(editors_group)
# Verification: user automatically inherits group permissions!
print(user.has_perm("articles.change_article")) # Returns: True
4. Custom View Decorators for Group-Based Access
While checking permissions (has_perm) is best practice, sometimes you need to enforce group membership directly:
Python
from django.contrib.auth.decorators import user_passes_test
from django.core.exceptions import PermissionDenied
def in_group(group_name):
def check_user(user):
if user.is_authenticated and user.groups.filter(name=group_name).exists():
return True
raise PermissionDenied
return user_passes_test(check_user)
# Guard view to Editors group only
@in_group("Editors")
def publish_draft_view(request, article_id):
# Only members of Editors group can execute this
...
Interactive Quiz
Practice Quiz
Question 1
What is the primary benefit of managing user authorization via Django Groups?
Question 2
How do you assign a user to an existing Group in Python?
Question 3
What is the role of django.contrib.contenttypes.models.ContentType in the permissions system?
Question 4
If a user belongs to multiple groups with different permissions, what permissions does the user have?
Question 5
What exception does Django raise when user_passes_test rejects an unauthorized user and you want to return an HTTP 403 Forbidden?
Next Lesson
Django Forms & Validation
Continue learning with hands-on practice, examples, and exercises in the upcoming topic.
Related Lessons
| Previous Lesson | Next Lesson |
|---|---|
| User Model & Permissions | Django Forms & Validation |
Practice Quiz
Test your understanding of this lesson with 5 questions. Each question has one correct answer.