From bb76f6c652c45825fd4b30cda54bde9f61482829 Mon Sep 17 00:00:00 2001
From: ibuler <ibuler@qq.com>
Date: Thu, 25 Aug 2016 19:29:59 +0800
Subject: [PATCH] Add api authentication

---
 apps/jumpserver/settings.py                 |  10 ++--
 apps/static/img/logo.png                    | Bin 0 -> 6116 bytes
 apps/templates/_foot_js.html                |  32 +++++++++++++
 apps/templates/_user_profile.html           |   2 +-
 apps/users/forms.py                         |  13 ++++++
 apps/users/templates/users/login.html       |  48 ++++++++++++++++++++
 apps/users/templates/users/user_detail.html |  25 ++++++----
 apps/users/templates/users/user_edit.html   |   2 +-
 apps/users/urls.py                          |   3 +-
 apps/users/views.py                         |  39 ++++++++++++++--
 10 files changed, 157 insertions(+), 17 deletions(-)
 create mode 100644 apps/static/img/logo.png
 create mode 100644 apps/users/templates/users/login.html

diff --git a/apps/jumpserver/settings.py b/apps/jumpserver/settings.py
index 0692be641..b70bf8950 100644
--- a/apps/jumpserver/settings.py
+++ b/apps/jumpserver/settings.py
@@ -172,9 +172,13 @@ FIXTURE_DIRS = [os.path.join(BASE_DIR, 'fixtures'), ]
 REST_FRAMEWORK = {
     # Use Django's standard `django.contrib.auth` permissions,
     # or allow read-only access for unauthenticated users.
-    'DEFAULT_PERMISSION_CLASSES': [
-        'rest_framework.permissions.DjangoModelPermissionsOrAnonReadOnly'
-    ],
+    'DEFAULT_PERMISSION_CLASSES': (
+        'rest_framework.permissions.DjangoModelPermissionsOrAnonReadOnly',
+    ),
+    # 'DEFAULT_AUTHENTICATION_CLASSES': (
+    #     'rest_framework.authentication.BasicAuthentication',
+    #     'rest_framework.authentication.SessionAuthentication',
+    # ),
 }
 # This setting is required to override the Django's main loop, when running in
 # development mode, such as ./manage runserver
diff --git a/apps/static/img/logo.png b/apps/static/img/logo.png
new file mode 100644
index 0000000000000000000000000000000000000000..0d8ff20a6b7ad21f50bd998736adec930b76b30c
GIT binary patch
literal 6116
zcmV<A7aQn_P)<h;3K|Lk000e1NJLTq004gg004go1^@s6#=RXA0000PbVXQnQ*UN;
zcVTj606}DLVr3vnZDD6+Qe|Oed2z{QJOBU}hDk(0RCwC#T?v>J)wRC0bye>@)7`W8
zzyPx_GXk<J5fBt+Km(#^qE97i6!k?z4DU;PF^`0pyoC6C(f0*;PYnr30t5mIGQb!1
z&0&#s0yE4oD>Kv6OZ8U0R8`ljI|>o$ntghyp8xy$W0<a~x^@10&pqedbI(OGHmm`1
z!b_a6%pPDC(i~gh;90!~prjW8NPxhRAVvTd#{h?6fJZSPAmSH-0I)C*aGnPQ#{-gQ
z0mboxMi2z8AOurT+?A>zt5XPa+iC^+wwz>zBr^H0hQa*nKJOc?p-^!f2&?T15_PN8
zfXC1Qe-_4vfsXM3Qz#ft2dFPgK~!a^v@74iz|JA^ql6_)U_*VtSJnuC!KzdtUZpZ-
zZPEDsAl=Uh7J$&hDOJT<74`TK`2&on{h@VrjCa8`6lmIXI)uaUxN9TMb0EX*5=H>T
zJAzVeU#p~^93sDuc!d|{)OcL)*Mzy8CXEgWDijGbqR3DPSiEkb08=!NQtO_32M2qG
z$nOEZ8{}41d0k6ua7<&>8xr2AN^{YmfakrV)%y4TkHnV`kskry@dsC5WZX-tDJA7n
zYk=IK_jy4<AQ%{<(XRb~RJ=GuzKErv@QSl;=kk9jNtGN)kJJf92ZGF4tzp#~1-2q7
z$$t$H#h*Lc4_&}9V~0);k_~3J3yk4;`?yr|^tS}QDrv}H?D3vD#RkS-OEn=N$&u%<
z2@?tG%x0}-Vzi%)M)P4Wv;30Dc003^z$Xk5{{^5NpgbnqZOqGTc!?}W{=*(`<w-6y
zu`wleh;#|$Ivv7PoIJHjtDY>Ikw3%fpm*cwq#@$F29(dI7&7Tzr;|>2@?T)NpOo5d
z?7@^&y;rFkVz&qIs#IWqN{YVJ-oY+q!#_z#wf}^V*>xlonA<Qk+WR#POea;l*Q==V
zgc<n{x!o7{@@&}<@%^6$cC&%9huq$a2|@lm+SRlVLrbhl=(`UFI`jtccMO!wbGe%0
zn*95mPU`_mk&_IOx@f{J%JTrJ$eBYst#L{IY=@)ch)Qi{DCH1ag8(SkLrS%IHtpz$
zEAnSM9oD02jVVAXhFBUzK=~e3YE1VJkOt^C`Q=Vm({ZKJJVbmHI{-zQ=h4o7+W`Ga
ziGf!AJ_VK&D^-7^@#z>2rmHl9ks!dNwCtce6hM_2F5nm@)VpZH$Fm5DqQDvmAbUMD
zqC!xBiGD~k#{q{BPRJ?X2+!v%@^~+9)oMzk?&m+j_;>B)LS@mk>Y?8#h@Ud0223%e
z@(b^n;5O=0a017*;;+L!&}28S5d^{Sbh`o+Ng_2ZjaZGXjjU+9uGq<V5~dTFT{I|D
zP!;QxeTxJ1iF_D&s_@c3uaB}H|5A!s`0@P@dNC9u5CowH^I3J*o9Hc<KG&^xbfDHS
zAGaMK*I^gt>x@5Lje}oAh5Rvg8++bpidq)sLu#Gy<0&&-mh?=u_+KI>sy5)Kcbz+_
z-q6xO91Hs6ssohTI=G7_GcoAo&vZKI11YId)Aes;SooLjEyv<;(1lOeR52T?tJE7k
zP9!7<F>TBYhs|{`)nphn@*nZ|Dl0H#5?p+U2HwdlWEW4J(Or*bZ)gK?9`}jUf%?ne
zhr~}*U62cP)t;wM9@e(TV4Bb{445YfCpW2kz8u_R^1sJ}CEMMO52Lj#`=hk%@T;@u
zM>OC<97~^Vs3W)5T%v+J4;q63q@E3dTtWfd;{WS;7Fz#cr04;ta2#Z*wfrPY9y2l{
zTP=1Fw)4diL;(gNyd4gQeXmz+RsGdXBfcnm5*E8%Sd?OZ=67g#?SPUGGjJ-6#;Evo
znJ5NMKl%(S5_HR`KXa{y`Sa!T%1tguztn6It^m_?dcjO7g(=y?g8AuLffTitKv8tS
z;?mbU+MS1MFKhN&TZzy8en1O6@QH2a!Qf60lWbQ1NmH6?z{p?h@txX9U=tXMib@aO
zJZ3WUjgoP<yuk6AD*vKWM+T+ysSpGd5+oQ!QUWIaJjXJEosyUDOV#R92I?6;KSQ6o
zdYL@b(m);Yx{#|J3z$K$6I6i!cz|V3Z_;Wf_M80I5UhBsz5Qaea_-W^QGfPpqn;1*
zo>3b=)CNHGj4Ie6v<M1DDM)a?IWs(aWT9_FMmCE6)28Sbc%Jv>Z2DkOR=|eaI)ugM
ztkP8iTh)^wnIz6S?1!S6Z26ErMfke9uWxS^qDg$GYbTCMMpV`90R|jxszra<T&Gou
zQpi9FaF5u=`-hDTP8dGQuOg{FX$K6$25srH-eg8j*;)?)qsi1~^5KSxEf`{qrqCZQ
zDD{f}XutZq2AfrJBf1wWKpP_@Hh>O?z-4<o^1i*DQh$De(uo>koKgkmX616z@(R4!
zMzf|nxr#<-VCC*@B={m|IViY@<Hi>`e#L5BdSghJ*6um4b9uBkRFvlB-)3020)8~M
zUUUQk#gA9C=C6xx-KRbec(vvdK5fr7!w)|FE7qMi@bvZ#)M{tPplVZ?1ajJG?{aUT
zB>B&V_|;V;8TG77QRUwzypcw85F`NdaRR(m{;*_QgP{;zviSq`UcWCY?YXQ{slFRx
zSNEFy^B#Ihv@>#`3nq??z}J7TrBpl~=fsnu2H!gW5vSCe1IuylS=&A`(BbImFqi>!
zhITCJ75PiK@TzKxq@pcAm#9KT;oYVVbJH_%KF-PibzT9hRcTTr=6L^-PyV8-<JqXU
z>#9mcy}+`odQAQW7ritVd3dc~kWWUkjEnL3O%|C&sla1XXGqTBuUBlP_K99YEa1{;
z!Fi`+X^+T%H7v}j!O@sxU}{9a+ROM{k?f@DTD=gD#6!l{%zelyW#J#X__=>AZI5XR
z`&E+EEECW<-I9OR<9<I@6)|8eJRCV5j=nN&79Ee|e^fHTuTiN}q%8aAFP@5dMk}=Z
ztDN@tyCwe$$L7S+ecEvHs4miXdW}w5fDv&;{5+Kg%)Dc~q|v;5*A|sah!2HT6M@%T
z8vaa(UDu@5#Z*P@bJ(D($3<`fsYS-LxJkH!Vdys|&!8jOD4j8qx@ylxHyt-SmRbx3
z<Y~Wuoh12JeVzreu6lJM=!e#EMC1OY8FRfl1dR(}{xD}aH#{?2$~NMktURRULHw90
zkk@LDYk?&BbwG&uRvT6n*pAc3BaRpX$8|55(qlgQCn-qqttrzPDI@P!ySJkqahMfc
zkKvk#<UbqYH?-;WaiON(t*?RVC!+LzaNmRBlo*fx-`zcnCU7F6ZBpCP==xxgL$`f4
z{6y9N6vJ$|jr?mqcUintw!FXwK~+PoSK@1Y-T1q`v1;1_wGQNETJ%!Z{clbm)%)Uf
zF977X&f_V&jr@9nkE@D@uT&n^Nqsk=pjh)*jQsxpytmv5Bv#|rAKOpDMV@#@GYSm1
zkpCJ=%!fsc<EfFCxDfcCeV>Mb#7gde&08E8jYrq@`?l5~7_|C`KD~$WIp4e9fO8<e
zVbf@lWnnP?CiyKM`i*!joATTC7L?<;h$<dMQROEOJVsL>I(=4wAYkR}2V7F$udh6$
zyT->m^#DMg8{PC9H_2}f1dHRbp+RxbKeqkPTB+~VN|mAJ(eFfM{(nBjEWqbQoJ++H
z`pecP3?vAe1ODQh<imps;<cf0cg&^}2PK!oaM67^GQG?-m~DWO#h35CS2Dc($?4+?
z4kQk&=ofj2o#ew4D&o1ZuU@-C)VDTE3V&pFuKwtZ@<EIJzmPMW6X$v<gP42s3)eJZ
zKr2<9e50=jU>Q7`B;Ik?flm!mzCXl>EQ_IX)`J7y0kTE+=;4WX`y?!UVgLElYzv=A
z;~oIFN&}V#g3HhjKeKQ!&ZHR(+_!mcmkqU~XBw&(Jnl3PU=V0&dJa!2$cTQu&(FAi
ze&s^K)uDlWclbREQAa3LkSL9Y?%#qfe*!nQTtx!RraAZ6v!N-9{wE?qPvY6>_lKmu
z-%xp2dzA};M1(yUDnK0^n@}~=DnkLVZ09B%rawzv1NY%=d-y5-DSc|c0zp5_$PSD5
zia4@iPTsqsh0lS+gfkr0qww6hL~Hm)j|*9{eFMdZ!(F*~*ste3g8XUpxB%IQSOE0v
zpTB30<o$P?IZkyXU`dyoQx=Mms22qZStWCi-v<_NTd!d`*4@>0_m7)QU0V1A-J3)Z
zD3I4Pa(TFlD0R*MHr6F{1uBNX5j23~30ordcrXC&+PY3>r=8BOu7kmu1B;ggNA+;w
zDo^Yvi|?Ew*{Nuc%XyX!CNlRRKoAHT#EFD{3Fu}`t=N)srRiFi8USY8=+K@8;hxRN
z;ZpU6h@&1Fo4+}{H{p-{3gHTX!n0))9dO&!%p-eso4bevivGC&0^7Z14tM81F?Blh
z>mv%L&EDay5N(b`ml=!W0ELGN%LT7oyFx7e_%HCsTa56dRp*!`RcDlJ57Md@Y7K&v
zU*GB8o&8MT7UmOPR?yc+c~m~+Lu~iC!T60I;Qwf-b#pxLsl0sA`|Wd;s-9Nzcy01@
z$tYns9QOa-)`ki)kQ3w`7ZCZC#D_b7W*z&xu2h`YF7_e_lMn0nnA0Wq+wVAi3}pmC
z7BYgoqlipiCK7r>JoE!r6prb#z}}jMT2d~ufxM%b4Cb$a0IbJ5cGyVCsG-$ibDl|X
z_wK8JyrVcjL_UN8!GKYpBDKplxTf-mK~C?B@nL`x+z|N?qbX^P?(;Lu7MERC#u34B
z03|s#>4}G|&P&gh6hxcDhPKOWdQ^z^5K3{ZknH3S7p?rcrQ;<Ran80h$nNYIGQ<j~
ziVr6}`6UV!(5W?2>C4<HyOogJJ1bd{d>u@ZO>#Uns*sV|ZOa7w-b$ZGcEJ!e#|F_<
zoNy&O`Qt|vN(KbZ)Lv24$j~m*gasFBR4A&GnRvL)FO`oEQQ6i^aWZ^wJ%&`HCQ7{x
z`h3ZXe;ZNQ)wCyUuv<~Ny))$7q*QN1-^IY&I>wu{qkcy5SjjS3cG^K(Wf%n0`MhAg
z(e!p_uTBjHl5*&OL#q>{iYdWSzv=8}Iu^*!8PYMnPQE+IPYVNIGLrv;yQM39!I17B
zt*w|G-#aB3@ZBWeqEuET8}V=_j#Mlk;(T2-+sJdWe0MW~RsEBEed<b$pGhk6R~3!z
za{2bpS1xGe82y3=G3BT=D{qqjR+!ys_Ii^h(l?GE!Hm*7!(FKSz($u7k>k6kdR)RE
zjHx?sk`Ivs1Uearhnq2eRCtFUMNz5Uslv9CN6-L}=U6cNnVUS{B!84vUxCYXj{7PW
zsCB|OO2$e0Z?N`nqHoBM0^~P`pek-7{|^-Pcp6R1UiJU@u6t>$izC$j_}M{SPg1-S
z5hkZo*q)vJ_-*7v4C8rOM|&RC7=%nynxusv2nJp6v|mSgnX3GBkLMPCZy|rQK4m)@
zl4q}n+pXW6J-^FEtaT?2XxxH4<6V$f3x;o(B>zKF@nk0Llx4U7ePL-(qf$#Q;BY+W
zdGmUsEQ30oquyZ`cI4(hDM>y=0g5)u?ZqEZ=|K7TySg;uUf#J`8wBz-d9r=J+jzZ=
z{1RjOb0*p;AHNns!8>IOp}Lp!+u<h9kK?>@X1@$Qk<XD@!*kt||27idGa}%Zjp4U$
z!Zfdvq$Ky=!GO-co;awJv!R>muzT01nf7!`KE$1==J)j8#2*Q74a?`o=a25Hv}pME
z2X-kgav|9g4|y!0$oC?B7m@rm3SxPl#}i28mwr7xC;a%`_u`<7vjeN@uX>?tC+AV0
zW$OrR$+9f(G5MXN-;lai=S@8A4=48L3`XI5v*vY4YP-YceEH-Nom^cz2pt^tD85$e
zdr1NPK}o$h%I!|LrM~~j9LBFKf4Iv<nP4dB`u@RPDVJre?jbB4?acPv+!uRIKExEW
zd6m(XIF|prBZ@*V%$(aL@vwr|ulDWK9SHbkO+4hSNTFEOrIyUtu%^qK+|zd5b~q!;
z7|$;{K|z8o4}QzlRYi?X>n<Gj{rCP)m8-1sp65HK?W@)H&qo!Qy1J%YAxzD*OwYBp
z#clNC1%pZW+kz)N-4QQ>eRuz^q#!=0y;T@v&`<B~x^4xrO5m%;W5gL{Aij+MF@ysA
zrF5cyMfoCFFHhUmwW2Q{dUN;R@ZVZnWKTTgX{5({=8vZIZd3ERRr@zEwxyXlmz@*y
z4T}>95-iIv4$Lea&%pzhySpCF@!#6^k>*Iy50U{z*J}Nj^G5dQ*pwb0r!^xZ`z4#r
z`eBPHEhgzrb77hA!cyPVqA{?da*wJi`-1`3Q#&{7lZE)qj&@;;f_&+6Pu=34j(mu3
z+H95kRH{i{)!?7UgNYvdbV>;pWLnt8lkW+^V#?yDN4sTV$acfA{rC?Xui_v{024Fs
zY-v7uIKN<WPyeP@!ui-_nmnbYnf^?r8n8;;nJ5N)f&j)UD3C`{!dQcmpP66m(QCBG
zmwV`lFF!p&*ym^5-{14GVF%*|$%GNtn_ayjzSkrF1`4k?vsbcm`ZcPa)~5=;EL+5c
zIF_USX{m>MVuVT=bsrtuhyHt09Uc;rtK`7QrUtIoGOX7%1o|ZCnMU)^ayqPimN3kq
z{qESwZkRz!-Rh$Cr9JGq+AE&tKi;TV-dLM-#AjLCg<_ujSzrFPPosAYN&eyy44<~2
zc9z)<DZT!CSi;h%)AuW=4oj`?ICFw}zp+knh7A%R31Ot2pwQ*q{Yie&FQP_1#9vcW
z%jaCbe(?lBl(^NsJA51F#Ou`BKBY&Cb2`20)KSga)@EHbpS;DS;7;58w$@Agi;Bzp
zdXIk1+k3LIN@uh*HJ!w;9EMW%>Y+}LD`eECba$**rwwqWvCe(Exk2??aXuG~LxY@G
z;(7vAzz_0Unww7)6_@tsKK*uu4rW^{Q=1yCXVWsw0kUU<8P56QT#tOsU<<;!I9|p_
zTWJS4*;uFEZ*3*^G9JJPf({I!6I3t+3K|<bP8Sqe`g^ZFS^JSNwW*=wY+9zNryT$S
z9!G8=N#PRXLww;dsOMN<4fCCyBiRhMo)TZ!SZ6zzUt}JL`wbZRUvz**>v^-;+?y$2
z2)$7C4fP%83P-06)IA4uq2q)lH*I1^M>8}=hA^<k-RSzd=7A)Bz{!U=WXZKmayl*<
zWt9FMYj>`=so~P;q7utM-+NG&IRBoLTRJV^ugJ1mhbHcR25|0Zzg}^osHAi-?muYj
z+aG6SmEWfzembh9i5sG^_ZZb!&)w;E{q#U#N%>$sV?Yf)DNJa%Mqe?f>!Yz6nCO73
zb9pU|t_%4^gI?c1Dw!>(hvgaWvfEB(b_`7eU7>S5zP|2cG>DHH`4D?8xs%Hk<TJ(f
zb^dru35zwLJc{bB`X|xuXO0z@PL9@dqoVe|j#>4!r>d2z@y+R(NU{?TlPxWF+nM9V
zcT9}-vtyFbxNrE#i4Umtr4z5!+7oGCz<|1N;(L$1a@l^D-(MOF;$t@QzlulO+E!fh
z`<6GE(^PJaR`#UBEmYaoHf9*huBs?3UJ=W-#GL#aSlHaS`ZC8YX*HQCmkc`r+%22Y
z(H_Y52iNW^E_pE?+7vhB-@u~g=2g|9z|yu<qsG>UM3Hy{ER2wD@9<``+<SY9ikHVz
z+v1M=8~B&D_BqvF`u#SIHm5z+gaj3dQyLEzKN1NS%r3gwLXgjG8#!uEJhn4#$^R<K
zuhp(=5rhR+olav*Nkup;{xY&*fkTtiA(&{|o5qE<?<*>OGT!By5afRqWwo^%S_Qt$
zsnHl5Is+2Rs3DBTrMR3zipN8nc)nua=#s}1NtOvm{w<zDbL0G0#`}g7BZ@srm0I)`
zP?%2$&xRjpz@tgv(yG?$4(t4WpDq-vN=5ONI|_?-CaU}rn*2!kX5H0gG#gszMbH9<
zAoQZGKn6$>2@(n<L?{4@<DH!Yo*xg75r?Nq!$XB3x$uZl1seh+8xp8sP!Q+tpeht{
qDLJlMhhf`x6&1fNCt3Z!00RKEMcLO6#G#J>0000<MNUMnLSTaSjRC~~

literal 0
HcmV?d00001

diff --git a/apps/templates/_foot_js.html b/apps/templates/_foot_js.html
index 0517a5dbc..b610cb089 100644
--- a/apps/templates/_foot_js.html
+++ b/apps/templates/_foot_js.html
@@ -17,4 +17,36 @@
         $("#"+s1).addClass('active');
         $('#'+s1+' .'+s2).addClass('active');
     }
+
+    function getCookie(name) {
+        var cookieValue = null;
+        if (document.cookie && document.cookie !== '') {
+            var cookies = document.cookie.split(';');
+            for (var i = 0; i < cookies.length; i++) {
+                var cookie = jQuery.trim(cookies[i]);
+                // Does this cookie string begin with the name we want?
+                if (cookie.substring(0, name.length + 1) === (name + '=')) {
+                    cookieValue = decodeURIComponent(cookie.substring(name.length + 1));
+                    break;
+                }
+            }
+        }
+        return cookieValue;
+    }
+
+    var csrftoken = getCookie('csrftoken');
+    console.log(csrftoken)
+
+    function csrfSafeMethod(method) {
+        // these HTTP methods do not require CSRF protection
+        return (/^(GET|HEAD|OPTIONS|TRACE)$/.test(method));
+    }
+
+    $.ajaxSetup({
+        beforeSend: function(xhr, settings) {
+            if (!csrfSafeMethod(settings.type) && !this.crossDomain) {
+                xhr.setRequestHeader("X-CSRFToken", csrftoken);
+            }
+        }
+    });
 </script>
\ No newline at end of file
diff --git a/apps/templates/_user_profile.html b/apps/templates/_user_profile.html
index f62bc6d28..4c2d07a48 100644
--- a/apps/templates/_user_profile.html
+++ b/apps/templates/_user_profile.html
@@ -7,7 +7,7 @@
         <a data-toggle="dropdown" class="dropdown-toggle" href="#">
             <span class="clear">
                 <span class="block m-t-xs">
-                    <strong class="font-bold"> Admin <span style="color: #8095a8"></span></strong>
+                    <strong class="font-bold"> {{ request.user.name }}<span style="color: #8095a8"></span></strong>
                 </span>
                 <span class="text-muted text-xs block">
                      {{ role | default:'普通用户' }}<b class="caret"></b>
diff --git a/apps/users/forms.py b/apps/users/forms.py
index d1621728a..cc6b551c2 100644
--- a/apps/users/forms.py
+++ b/apps/users/forms.py
@@ -6,6 +6,19 @@ from django import forms
 from .models import User, UserGroup
 
 
+# class UserLoginForm(ModelForm):
+#     class Meta:
+#         model = User
+#         fields = [
+#             "email", "password"
+#         ]
+
+
+class UserLoginForm(forms.Form):
+    username = forms.CharField(label='用户名', max_length=100)
+    password = forms.CharField(label='密码', widget=forms.PasswordInput, max_length=100)
+
+
 class UserAddForm(ModelForm):
     class Meta:
         model = User
diff --git a/apps/users/templates/users/login.html b/apps/users/templates/users/login.html
new file mode 100644
index 000000000..96a86e217
--- /dev/null
+++ b/apps/users/templates/users/login.html
@@ -0,0 +1,48 @@
+{% load static %}
+{% load bootstrap %}
+<!DOCTYPE html>
+<html>
+
+<head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title> JumpServer </title>
+    <link rel="shortcut icon" href="{% static "img/facio.ico" %}" type="image/x-icon">
+    {% include '_head_css_js.html' %}
+    <link href="{% static "css/style.css" %}" rel="stylesheet">
+    <script src="{% static "js/base.js" %}"></script>
+</head>
+
+<body class="gray-bg">
+    <div class="middle-box text-center loginscreen  animated fadeInDown">
+        <div>
+            <div>
+                <h1 class="logo-name"><img src="{% static "/img/logo.png" %}"></h1>
+            </div>
+            {% if error %}
+                <div class="alert alert-danger text-center">{{ error }}</div>
+            {% endif %}
+            <h2>Welcome to Jumpserver</h2>
+            <form class="m-t" role="form" method="post" action="">
+                {% csrf_token %}
+                <div class="form-group">
+                    <input id="{{ form.username.id_for_label }}" name="{{ form.username.html_name }}" type="text" value="{{ user.username }}" class="form-control" placeholder="Username">
+                </div>
+
+                <div class="form-group">
+                    <input id="{{ form.password.id_for_label }}" name="{{ form.password.html_name }}" type="password" value="{{ user.password }}" class="form-control" placeholder="Password">
+                </div>
+
+                <button type="submit" class="btn btn-primary block full-width m-b">Login</button>
+
+                <a href=""><small>Forgot password? </small></a>
+            </form>
+            <p class="m-t"> <small><b>Copyright</b> Jumpserver.org Organization © 2014-2015</small> </p>
+        </div>
+    </div>
+
+    {% include '_foot_js.html' %}
+
+</body>
+
+</html>
\ No newline at end of file
diff --git a/apps/users/templates/users/user_detail.html b/apps/users/templates/users/user_detail.html
index eccbbf06c..88188c28e 100644
--- a/apps/users/templates/users/user_detail.html
+++ b/apps/users/templates/users/user_detail.html
@@ -62,8 +62,7 @@
                                         <tbody>
                                         <tr>
                                             <td colspan="2">
-                                                <img src="{{ user | user_avatar_url }}" class="img-circle" width="64"
-                                                     height="64">
+                                                <img src="{{ user | user_avatar_url }}" class="img-circle" width="64" height="64">
                                             </td>
                                         </tr>
                                         <tr>
@@ -134,12 +133,8 @@
                                             <td><span style="float: right">
                                                 <div class="switch">
                                                     <div class="onoffswitch">
-                                                        {% if user.is_active %}
-                                                        <input type="checkbox" checked class="onoffswitch-checkbox" id="example1">
-                                                        {% else %}
-                                                        <input type="checkbox" class="onoffswitch-checkbox" id="example1">
-                                                        {% endif %}
-                                                        <label class="onoffswitch-label" for="example1">
+                                                        <input type="checkbox" {% if user.is_active %} checked {% endif %}  class="onoffswitch-checkbox" id="is_active" onchange="switch_user_status(this)">
+                                                        <label class="onoffswitch-label" for="is_active">
                                                             <span class="onoffswitch-inner"></span>
                                                             <span class="onoffswitch-switch"></span>
                                                         </label>
@@ -232,6 +227,20 @@
 {% endblock %}
 {% block custom_foot_js %}
     <script>
+        function switch_user_status(obj) {
+            var status = $(obj).prop('checked');
+
+            $.ajax({
+{#                url: "{% url 'users:user-detail-api' pk=user.id %}",#}
+                url: "{% url 'users:login' %}",
+                type: "POST",
+                data: {
+                    'username': "{{ user.username }}",
+                    'email': "{{ user.email }}",
+                    'is_active': status
+                }
+            })
+        }
         $(document).ready(function () {
             $('.select2').select2();
         })
diff --git a/apps/users/templates/users/user_edit.html b/apps/users/templates/users/user_edit.html
index 93344d346..e99a3ed5c 100644
--- a/apps/users/templates/users/user_edit.html
+++ b/apps/users/templates/users/user_edit.html
@@ -3,7 +3,7 @@
     <div class="form-group">
         <label for="{{ form.username.id_for_label }}" class="col-sm-2 control-label">用户名</label>
         <div class="col-sm-9 controls" >
-            <input id="{{ form.username.id_for_label }}" name="username" type="text" value="{{ user.username }}" readonly class="form-control">
+            <input id="{{ form.username.id_for_label }}" name="{{ form.username.html_name }}" type="text" value="{{ user.username }}" readonly class="form-control">
         </div>
     </div>
 {% endblock %}
diff --git a/apps/users/urls.py b/apps/users/urls.py
index dfcb56608..4d12874a8 100644
--- a/apps/users/urls.py
+++ b/apps/users/urls.py
@@ -1,12 +1,13 @@
 from django.conf.urls import url
 
-from .views import UserListView, UserAddView, UserUpdateView, UserDeleteView, UserDetailView
+from .views import UserListView, UserAddView, UserUpdateView, UserDeleteView, UserDetailView, UserLoginView
 from .views import UserGroupListView, UserGroupAddView, UserGroupUpdateView, UserGroupDeleteView, UserGroupDetailView
 import api
 
 app_name = 'users'
 
 urlpatterns = [
+    url(r'^login/$', UserLoginView.as_view(), name='login'),
     url(r'^users/$', UserListView.as_view(), name='user-list'),
     url(r'^users/(?P<pk>[0-9]+)/$', UserDetailView.as_view(), name='user-detail'),
     url(r'^users/add/$', UserAddView.as_view(), name='user-add'),
diff --git a/apps/users/views.py b/apps/users/views.py
index 058a0b380..14ba96268 100644
--- a/apps/users/views.py
+++ b/apps/users/views.py
@@ -2,17 +2,50 @@
 
 from __future__ import unicode_literals
 
-from django.shortcuts import get_object_or_404, reverse
+from django.shortcuts import get_object_or_404, reverse, render
+from django.http import HttpResponseRedirect
 from django.urls import reverse_lazy
 from django.db.models import Q
+from django.views.generic.base import TemplateResponseMixin
 from django.views.generic.list import ListView
-from django.views.generic.edit import CreateView, DeleteView, UpdateView
+from django.views.generic.edit import CreateView, DeleteView, UpdateView, ProcessFormView, FormView
 from django.views.generic.detail import DetailView
 from django.contrib.messages.views import SuccessMessageMixin
 from django.conf import settings
+from django.contrib.auth import authenticate, login, logout
 
 from .models import User, UserGroup
-from .forms import UserAddForm, UserUpdateForm, UserGroupForm
+from .forms import UserAddForm, UserUpdateForm, UserGroupForm, UserLoginForm
+
+
+class UserLoginView(FormView):
+    template_name = 'users/login.html'
+    form_class = UserLoginForm
+    success_url = reverse_lazy('users:user-list')
+
+    def get(self, request, *args, **kwargs):
+        if self.request.user.is_staff:
+            return HttpResponseRedirect(reverse('users:user-list'))
+        return super(UserLoginView, self).get(request, *args, **kwargs)
+
+    # def post(self, request, *args, **kwargs):
+    #     print(self.request.user)
+    #     return HttpResponseRedirect('/')
+
+    def form_valid(self, form):
+        username = form.cleaned_data.get('username', '')
+        password = form.cleaned_data.get('password', '')
+
+        user = authenticate(username=username, password=password)
+        if user is not None and user.is_staff:
+            login(self.request, user)
+            return HttpResponseRedirect(self.success_url)
+
+        return render(self.request, self.template_name, context={'form': form, 'error': '密码错误'})
+
+    def form_invalid(self, form):
+        print(form.errors)
+        return super(UserLoginView, self).form_invalid(form)
 
 
 class UserListView(ListView):