# Django registrations controlled by admin

**URL:** <https://forum.djangoproject.com/t/django-registrations-controlled-by-admin/27931>\
**Category:** Getting Started\
**Created:** [February 9, 2024, 5:08pm UTC](https://forum.djangoproject.com/t/django-registrations-controlled-by-admin/27931 "2024-02-09T17:08:56Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![AnatoliyViktorovich](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/anatoliyviktorovich/32/20294_2.png) [@AnatoliyViktorovich](https://forum.djangoproject.com/u/AnatoliyViktorovich)\
**Post date:** [February 9, 2024, 5:08pm UTC](https://forum.djangoproject.com/t/django-registrations-controlled-by-admin/27931/1 "2024-02-09T17:08:56Z")

</div>

Greetings!

I’m new to Django, I created several simple projects following tutorials and I’m ready to start building a real project. I need to build an application for my organization, so it should be password protected, however I need somehow to allow to register and log in my coworkers only, I need somehow to prevent a possibility to register and login for others.

Please advice how I can achieve that in Django.  
Thanks in advance.

---

<div class="post-metadata">

**Author:** ![KenWhitesell](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/kenwhitesell/32/280_2.png) [@KenWhitesell](https://forum.djangoproject.com/u/KenWhitesell)\
**Post date:** [February 9, 2024, 5:25pm UTC](https://forum.djangoproject.com/t/django-registrations-controlled-by-admin/27931/2 "2024-02-09T17:25:16Z")

</div>

You’ve got at least three options -

- Set the `is_active` attribute to False when a new user registers. You can then review all users with `is_active == False`, and delete (or simply ignore) the improper entries.

- Create your own “Registration workflow”, such that people registering create an entry in a _different_ model (not your User model). Then code a page for yourself to approve these entries, where that approval process copies the data from that temporary model to `User`.

- Don’t provide a public registration page at all. Make people send you an email to register them. You create the User entry with an invalid password. They go through the “Reset password” process to enter their password.

I’m sure there are others, but I’ve used all three of these at one time or another.

---

<div class="post-metadata">

**Author:** ![AnatoliyViktorovich](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/anatoliyviktorovich/32/20294_2.png) [@AnatoliyViktorovich](https://forum.djangoproject.com/u/AnatoliyViktorovich)\
**Post date:** [February 9, 2024, 5:43pm UTC](https://forum.djangoproject.com/t/django-registrations-controlled-by-admin/27931/3 "2024-02-09T17:43:04Z")

</div>

Thank you Ken!  
The third one looks the easiest, I’ll try it.  
Regarding the first option. Where do I set the default is\_active = False? Somewhere in Django settings?

---

<div class="post-metadata">

**Author:** ![KenWhitesell](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/kenwhitesell/32/280_2.png) [@KenWhitesell](https://forum.djangoproject.com/u/KenWhitesell)\
**Post date:** [February 9, 2024, 5:55pm UTC](https://forum.djangoproject.com/t/django-registrations-controlled-by-admin/27931/4 "2024-02-09T17:55:04Z")

</div>

You would do this in your registration view, it’s not a setting you can change.

The AbstractUser model has that field defined with default=True. If you’re creating a custom user model that inherits from AbstractUser, you could redefine that field with default=False.

If you’re creating your User from AbstractBaseUser, then you would need to define it as a field anyway, because AbstractBaseUser defines is\_active as a class attribute and not a model field.

---

<div class="post-metadata">

**Author:** ![AnatoliyViktorovich](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/anatoliyviktorovich/32/20294_2.png) [@AnatoliyViktorovich](https://forum.djangoproject.com/u/AnatoliyViktorovich)\
**Post date:** [February 9, 2024, 6:25pm UTC](https://forum.djangoproject.com/t/django-registrations-controlled-by-admin/27931/5 "2024-02-09T18:25:05Z")

</div>

Thanks. Sounds too complicated for me at this stage. )