What tables does Django auth create?

Django's auth app creates auth_user, auth_group, auth_permission, and three many-to-many join tables: auth_user_groups, auth_user_user_permissions, and auth_group_permissions.

How do Django users relate to groups and permissions?

Users relate to groups through the auth_user_groups join table and to permissions through auth_user_user_permissions. Groups relate to permissions through auth_group_permissions. All three are many-to-many relationships.

What is the difference between is_superuser and is_staff?

is_superuser bypasses every permission check. is_staff only controls whether the user can sign in to the Django admin. A staff user still needs the relevant permissions, or superuser status, to change anything.

Does Django create these tables automatically?

Yes. Running python manage.py migrate creates django_content_type first, then the auth tables and join tables, then django_admin_log. You get all of them even if you only use users without groups.

← All schemas

Schema Library

Django Auth Database Schema Diagram

Django's built-in auth app creates a set of authentication tables when you run migrate: auth_user, auth_group, auth_permission, plus the many-to-many join tables auth_user_groups, auth_user_user_permissions, and auth_group_permissions. This diagram maps the full schema - including how permissions link to content types through django_content_type, and how admin actions are logged in django_admin_log.

Written by Varun Krishnan · Founder, dbdiagramr

Published Aug 2, 2026 · Updated Oct 23, 2026

Source: Django 6.1.2 contrib.auth and admin migrations (django/django) · License: BSD-3-Clause

Tables

Core table

auth_user

Join tables

Version

6.1.2

Django 6.1.2 built-in auth and admin migrations, checked against the 6.1.x stable branch.

Custom user models, third-party auth apps, and non-database session backends are not shown. django/contrib/auth migrations.

Django database schema diagram showing every table, column, and foreign key

Scroll horizontally to see the full diagram. Click it to open at full size.

Download SVG Download 2x PNG

Open in DBdiagramr to edit →

Embed this diagram

Paste this HTML into a README, docs page, or blog post. The image links back to the full schema page.

<a href="https://www.dbdiagramr.space/schema/django">
  <img src="https://www.dbdiagramr.space/schemas/django-er-diagram.svg" alt="Django Auth Database Schema Diagram" width="1946" height="982" />
</a>
<p><a href="https://www.dbdiagramr.space/schema/django">Django Auth Database Schema Diagram</a> by dbdiagramr</p>

Tables in the Django schema

Column	Type	Nullable	Key
auth_user
id	integer GENERATED BY DEFAULT AS IDENTITY	No	PK
password	varchar(128)	No	-
last_login	timestamptz	Yes	-
is_superuser	boolean	No	-
username	varchar(150)	No	-
first_name	varchar(150)	No	-
last_name	varchar(150)	No	-
email	varchar(254)	No	-
is_staff	boolean	No	-
is_active	boolean	No	-
date_joined	timestamptz	No	-
auth_group
id	integer GENERATED BY DEFAULT AS IDENTITY	No	PK
name	varchar(150)	No	-
auth_permission
id	integer GENERATED BY DEFAULT AS IDENTITY	No	PK
name	varchar(255)	No	-
content_type_id	integer	No	FK → django_content_type.id
codename	varchar(100)	No	-
auth_user_groups
id	integer GENERATED BY DEFAULT AS IDENTITY	No	PK
user_id	integer	No	FK → auth_user.id
group_id	integer	No	FK → auth_group.id
auth_user_user_permissions
id	integer GENERATED BY DEFAULT AS IDENTITY	No	PK
user_id	integer	No	FK → auth_user.id
permission_id	integer	No	FK → auth_permission.id
auth_group_permissions
id	integer GENERATED BY DEFAULT AS IDENTITY	No	PK
group_id	integer	No	FK → auth_group.id
permission_id	integer	No	FK → auth_permission.id
django_content_type
id	integer GENERATED BY DEFAULT AS IDENTITY	No	PK
app_label	varchar(100)	No	-
model	varchar(100)	No	-
django_admin_log
id	integer GENERATED BY DEFAULT AS IDENTITY	No	PK
action_time	timestamptz	No	-
object_id	text	Yes	-
object_repr	varchar(200)	No	-
action_flag	smallint	No	-
change_message	text	No	-
content_type_id	integer	Yes	FK → django_content_type.id
user_id	integer	No	FK → auth_user.id
django_session
session_key	varchar(40)	No	PK
session_data	text	No	-
expire_date	timestamptz	No	-

Table relationships

9 relationships connect the tables in this schema. Each entry shows the child columns, the parent columns they reference, and the cardinality.

One-to-many

auth_permission.content_type_id → django_content_type.id

One django content type can have many auth permissions (auth_permission.content_type_id -> django_content_type.id, required).

One-to-many

auth_user_groups.user_id → auth_user.id

One auth user can have many auth user groups (auth_user_groups.user_id -> auth_user.id, required).

One-to-many

auth_user_groups.group_id → auth_group.id

One auth group can have many auth user groups (auth_user_groups.group_id -> auth_group.id, required).

One-to-many

auth_user_user_permissions.user_id → auth_user.id

One auth user can have many auth user user permissions (auth_user_user_permissions.user_id -> auth_user.id, required).

One-to-many

auth_user_user_permissions.permission_id → auth_permission.id

One auth permission can have many auth user user permissions (auth_user_user_permissions.permission_id -> auth_permission.id, required).

One-to-many

auth_group_permissions.group_id → auth_group.id

One auth group can have many auth group permissions (auth_group_permissions.group_id -> auth_group.id, required).

One-to-many

auth_group_permissions.permission_id → auth_permission.id

One auth permission can have many auth group permissions (auth_group_permissions.permission_id -> auth_permission.id, required).

One-to-many

django_admin_log.content_type_id → django_content_type.id

One django content type can have many django admin logs (django_admin_log.content_type_id -> django_content_type.id, optional).

One-to-many

django_admin_log.user_id → auth_user.id

One auth user can have many django admin logs (django_admin_log.user_id -> auth_user.id, required).

Relationship	Type	Meaning
auth_permission.content_type_id → django_content_type.id	One-to-many	One django content type can have many auth permissions (auth_permission.content_type_id -> django_content_type.id, required).
auth_user_groups.user_id → auth_user.id	One-to-many	One auth user can have many auth user groups (auth_user_groups.user_id -> auth_user.id, required).
auth_user_groups.group_id → auth_group.id	One-to-many	One auth group can have many auth user groups (auth_user_groups.group_id -> auth_group.id, required).
auth_user_user_permissions.user_id → auth_user.id	One-to-many	One auth user can have many auth user user permissions (auth_user_user_permissions.user_id -> auth_user.id, required).
auth_user_user_permissions.permission_id → auth_permission.id	One-to-many	One auth permission can have many auth user user permissions (auth_user_user_permissions.permission_id -> auth_permission.id, required).
auth_group_permissions.group_id → auth_group.id	One-to-many	One auth group can have many auth group permissions (auth_group_permissions.group_id -> auth_group.id, required).
auth_group_permissions.permission_id → auth_permission.id	One-to-many	One auth permission can have many auth group permissions (auth_group_permissions.permission_id -> auth_permission.id, required).
django_admin_log.content_type_id → django_content_type.id	One-to-many	One django content type can have many django admin logs (django_admin_log.content_type_id -> django_content_type.id, optional).
django_admin_log.user_id → auth_user.id	One-to-many	One auth user can have many django admin logs (django_admin_log.user_id -> auth_user.id, required).

Common queries

These PostgreSQL queries run against the schema shown on this page.

Group and direct permissions

List permissions a user gets through groups or directly.

select u.username, g.name as "group", p.codename
from auth_user u
left join auth_user_groups ug on ug.user_id = u.id
left join auth_group g on g.id = ug.group_id
left join auth_group_permissions gp on gp.group_id = g.id
left join auth_permission p on p.id = gp.permission_id
order by u.username, g.name, p.codename;

Recent admin actions

Show recent Django admin log entries with the acting user.

select l.action_time, u.username, l.object_repr, l.action_flag
from django_admin_log l
join auth_user u on u.id = l.user_id
order by l.action_time desc;

Permissions per model

Count permissions attached to each content type.

select ct.app_label, ct.model, count(*) as permissions
from auth_permission p
join django_content_type ct on ct.id = p.content_type_id
group by ct.app_label, ct.model
order by permissions desc, ct.app_label, ct.model;

Users without a group

Find auth users that are not in any group.

select u.id, u.username
from auth_user u
left join auth_user_groups ug on ug.user_id = u.id
where ug.group_id is null;

How Django's permission tables work

Django attaches permissions to models, not tables. Every model gets four rows in auth_permission, one each for add, change, delete, and view, and each row points at the model through django_content_type. That indirection is why adding a model and running migrations silently creates four new permissions.

A user can receive permissions through a group or directly. auth_user_groups plus auth_group_permissions carry role-like membership; auth_user_user_permissions carries one-off grants. The two paths are separate, so a query that checks only groups will miss direct permissions.

The tables arrive in migration order: django_content_type first, then auth_user, auth_group, auth_permission, and the three join tables, then django_admin_log from the admin app.

SELECT DISTINCT p.codename
FROM auth_permission p
JOIN django_content_type ct ON ct.id = p.content_type_id
LEFT JOIN auth_group_permissions gp ON gp.permission_id = p.id
LEFT JOIN auth_user_groups ug ON ug.group_id = gp.group_id AND ug.user_id = 42
LEFT JOIN auth_user_user_permissions up ON up.permission_id = p.id AND up.user_id = 42
WHERE ug.user_id = 42 OR up.user_id = 42;

This lists every permission for user 42 through both groups and direct grants.