feat: disable django admin password login

Use the `HelusersModelBackend` which will disable
password login when HELUSERS_PASSWORD_LOGIN_DISABLED
is `True`.

Refs: PT-1987

Author: charn

palvelutarjotin/settings.py

@@ -338,7 +338,7 @@ def sentry_traces_sampler(sampling_context: SamplingContext) -> float:
 AUTHENTICATION_BACKENDS = [
     "axes.backends.AxesBackend",
     "helusers.tunnistamo_oidc.TunnistamoOIDCAuth",  # For django-admin Keycloak login
-    "django.contrib.auth.backends.ModelBackend",
+    "helusers.auth.HelusersModelBackend",
     "palvelutarjotin.oidc.BrowserTestAwareJWTAuthentication",
     "palvelutarjotin.oidc.GraphQLApiTokenAuthentication",
 ]

requirements.txt

@@ -348,9 +348,9 @@ django-health-check==3.20.0 \
     --hash=sha256:bcb2b8f36f463cead0564a028345c5b17e2a2d18e9cc88ecd611b13a26521926 \
     --hash=sha256:cd69ac5facf73fe7241d9492d939b57bd20e24f46c4edea91e6a900bf22c2d8e
     # via -r requirements.in
-django-helusers==0.14.0 \
-    --hash=sha256:424f97e7aa6792ae255de56344f765795444849ea82e9d4e01666494c28e960c \
-    --hash=sha256:79b922d51278a9e9793a00279782e5455b72e9e9d0f261dd17be2f0dbcbaa1f9
+django-helusers==1.0.0 \
+    --hash=sha256:0e33e238347a4088927675574a7dad179ee1f9d9e958daecfa4862ad6f63f79c \
+    --hash=sha256:c18ff8ff0ff8fb72c2b802e005c680d4d477273b705a5c524aaff31c665d8e25
     # via
     #   -r requirements.in
     #   helsinki-profile-gdpr-api