It depends on what type of system you plan to support. If it's for a hospital setting featuring many different types of actors, roles, and constraints, this re

It depends on what type of system you plan to support. If it's for a hospital setting featuring many different types of actors, roles, and constraints, this requires a greater level of sophistication. Beware, authorization is an Alice in Wonderland rabbit hole where one may fall far deeper than one expected to. A few years ago, I ported Apache Shiro from Java to Python, resulting in The Yosai Project: http://yosaiproject.github.io/yosai http://yosaiproject.github.io/yosai It was a grueling but rewarding experience. I honored Shiro in name and license, open sourcing everything and using Apache 2. I went even further than Shiro by adding two factor authentication workflow using totp and including starter modules for caching, data store, and integration with the web app I was using (pyramid). If you choose to use python, or even just want something to learn from and reference, check out Yosai. I put a lot into this work to make it useful for others, entirely on my own. I spoke with Tobias (podcast init) about the project some time ago: https://www.podcastinit.com/yosai-with-darin-gordon-episode-120/ https://www.podcastinit.com/yosai-with-darin-gordon-episode-...