I came across a use case where I needed to disable users without actually deleting them so a user could continue to be associated with their data and reinstated at a later date.
At first I thought that I’d need to roll my own Identity Provider but I came up with a method that is slightly easier to implement.
I added a BoolCol to the auto-generated TurboGears User Class:
Class User(SQLObject):
...
disabled = BoolCol(default=False)
...
I then changed the classmethod that SOProvider uses to get the user from the database to raise an SQLObjectNotFound when a user’s “deleted” flag is set to True.
@classmethod
def by_user_name(self, text):
try:
u = self.by_email_address(text)
except SQLObjectNotFound:
raise
if u.disabled:
raise SQLObjectNotFound
else:
return u
Note that this classmethod has also been modified to return users by email address.
This way user can effectively be disabled as they can no longer log in successfully. It’s cheating outrageously because raising an SQLObjectNotFound exception is clearly lying to the SOProvider, but it works effectively.