Is djangos default authentication and authorization [1] not enough (since you mentioned django in your post)? If so you could take a look at django-allauth it seems [2] or maybe at Stormpath [3] (external service) or ABAC [3] (which is probably total overkill, too enterprisy and is only used for authorization as far as I know).

[1] https://docs.djangoproject.com/en/1.9/topics/auth/

[2] http://www.intenct.nl/projects/django-allauth/

[3] https://docs.stormpath.com/python/

[4] https://github.com/cedadev/ndg_xacml