auth.py

class MyUserAuthBackend(object):

    def check_legacy_password(self, db_password, supplied_password):
        return constant_time_compare('*'+ hashlib.sha1(hashlib.sha1(supplied_password.encode('utf-8')).digest()).hexdigest().upper(), db_password)


    def authenticate(self, username=None, password=None):
        """ Authenticate a user based on mb_id as the user name. """
        try:
            user = User.objects.get(mb_id=username)

            if '$' not in user.password:
                if self.check_legacy_password(user.password, password):
                    return user
                else:
                    return None

            else:
                if user.check_password(password):
                    return user

        except User.DoesNotExist:
            return None


    def get_user(self, user_id):
        """ Get a User object from the user_id. """
        try:
            return User.objects.get(pk=user_id)
        except User.DoesNotExist:
            return None