Is djangos default authentication and authorization [1] not enough (since you mentioned django in your post)? If so you could take a look at django-allauth it seems [2] or maybe at Stormpath [3] (external service) or ABAC [3] (which is probably total overkill, too enterprisy and is only used for authorization as far as I know).<p>[1] <a href="https:&#x2F;&#x2F;docs.djangoproject.com&#x2F;en&#x2F;1.9&#x2F;topics&#x2F;auth&#x2F;" rel="nofollow">https:&#x2F;&#x2F;docs.djangoproject.com&#x2F;en&#x2F;1.9&#x2F;topics&#x2F;auth&#x2F;</a><p>[2] <a href="http:&#x2F;&#x2F;www.intenct.nl&#x2F;projects&#x2F;django-allauth&#x2F;" rel="nofollow">http:&#x2F;&#x2F;www.intenct.nl&#x2F;projects&#x2F;django-allauth&#x2F;</a><p>[3] <a href="https:&#x2F;&#x2F;docs.stormpath.com&#x2F;python&#x2F;" rel="nofollow">https:&#x2F;&#x2F;docs.stormpath.com&#x2F;python&#x2F;</a><p>[4] <a href="https:&#x2F;&#x2F;github.com&#x2F;cedadev&#x2F;ndg_xacml" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;cedadev&#x2F;ndg_xacml</a>