from django.conf import settings
from django import http
class SuperUserIpRestrictMiddleware(object):
    """
    Разрешает доступ суперпользователям только с определенных ip
    список разрешенных ip = settings.SUPERUSER_ALLOWED_IP
    """
    def process_request(self, request):
        if (request.user.is_superuser and request.path != u'/logout/' and 
                request.META['REMOTE_ADDR'] not in 
                settings.SUPERUSER_ALLOWED_IP):
            html_str = u'''
                <h1>Доступ запрещен</h1>Вход с ip {ip} для 
                пользователя <b>{user}</b> запрещен.</br>
                <a href="/logout/">Вернуться</a>
                '''.format(ip=request.META['REMOTE_ADDR'], user=request.user)
            return http.HttpResponseForbidden(html_str)
        return None

def clean(self):
...
if request.user.is_superuser and request.META['REMOTE_ADDR'] != u'127.0.0.1':
    raise ValidationError(u'доступ запрещен')

current_ip=request.META['REMOTE_ADDR']

# -*- coding: utf-8 -*-
from django.conf.urls import patterns, include, url
from django.contrib.staticfiles.urls import staticfiles_urlpatterns
from django.views.generic import TemplateView
# Uncomment the next two lines to enable the admin:
from django.contrib import admin
admin.autodiscover()
from accounts.forms import MyAuthenticationForm
urlpatterns = patterns('',
...
    url(r'^login/',
        'accounts.views.custom_login',
        {'authentication_form': MyAuthenticationForm},
        name='auth_login'),
)
urlpatterns += staticfiles_urlpatterns()

from accounts.forms import MyAuthenticationForm
from django.core.exceptions import ValidationError
from django.contrib.auth.views import login
from django import forms
from django.shortcuts import redirect
from django.contrib.auth import REDIRECT_FIELD_NAME, login as auth_login
from django.utils.http import base36_to_int, is_safe_url
from django.shortcuts import resolve_url
from django.http import HttpResponseRedirect, QueryDict
def custom_login(request, template_name='login.html',
                 redirect_field_name=REDIRECT_FIELD_NAME,
                 authentication_form=MyAuthenticationForm,
                 current_app=None, extra_context=None):
                 
    redirect_to = request.REQUEST.get(redirect_field_name, '')
    if request.method == 'POST':
        form = MyAuthenticationForm(
            data=request.POST, current_ip=request.META['REMOTE_ADDR'], 
            user=request.user, request=request
        )
        if form.is_valid():
            # Ensure the user-originating redirection url is safe.
            if not is_safe_url(url=redirect_to, host=request.get_host()):
                redirect_to = resolve_url(settings.LOGIN_REDIRECT_URL)
            # Okay, security check complete. Log the user in.
            auth_login(request, form.get_user())
            if request.session.test_cookie_worked():
                request.session.delete_test_cookie()
            return HttpResponseRedirect(redirect_to)
    else:
        form = MyAuthenticationForm(current_ip=request.META['REMOTE_ADDR'], 
                                    user=request.user, request=request)
    request.session.set_test_cookie()
    current_site = get_current_site(request)
    context = {
        'form': form,
        redirect_field_name: redirect_to,
        'site': current_site,
        'site_name': current_site.name,
    }
    if extra_context is not None:
        context.update(extra_context)
    return TemplateResponse(request, template_name, context,
                            current_app=current_app)

from django.contrib.auth.forms import AuthenticationForm
from django import forms
class MyAuthenticationForm(AuthenticationForm):
    current_ip = forms.IPAddressField()
    
    def __init__(self, current_ip=None, user=None, request=None, *args, **kwargs):
        self.current_ip = current_ip
        self.request = request
        self.user_cache = None
        self.user = user
        super(MyAuthenticationForm, self).__init__(*args, **kwargs)
        UserModel = get_user_model()
        self.username_field = UserModel._meta.get_field(UserModel.USERNAME_FIELD)
        if not self.fields['username'].label:
            self.fields['username'].label = capfirst(self.username_field.verbose_name)
    def clean_current_ip(self):
        current_ip = self.cleaned_data.get('current_ip')
        if self.user.is_superuser() and current_ip != u'127.0.0.1':
            raise forms.ValidationError(u'try from another ip!')
        return current_ip