Is djangos default authentication and authorization [1] not enough (since you mentioned django in your post)? If so you could take a look at django-allauth it seems [2] or maybe at Stormpath [3] (external service) or ABAC [3] (which is probably total overkill, too enterprisy and is only used for authorization as far as I know).