You can override the login form when you are setting up Flask-Security:

user_datastore = SQLAlchemyUserDatastore(db, User, Role)
security = Security(app, user_datastore, login_form=CustomLoginForm)

Then create your custom login form class that extends the default LoginForm. And override the validate function to do stuff before or after the login attempt.

from flask_security.forms import LoginForm

class CustomLoginForm(LoginForm):
    def validate(self):
        # Put code here if you want to do stuff before login attempt

        response = super(CustomLoginForm, self).validate()

        # Put code here if you want to do stuff after login attempt

        return response

"reponse" will be True or False based on if the login was successful or not. If you want to check possible errors that occurred during the login attempt see "self.errors"

Greetings, Kevin ;)

security/login_user.html is the full page template for the login form. It's not what you would want to embed on each page because it deals with other things like flashed messages, errors, and layout.

Write your own template to render just the form and include that, or add it to your base template.

<form action="{{ url_for_security('login') }}" method="POST">
  {{ login_user_form.hidden_tag() }}
  {{ login_user_form.email(placeholder='Email') }}
  {{ login_user_form.password(placeholder='Password') }}
  {{ login_user_form.remember.label }} {{ login_user_form.remember }}
  {{ login_user_form.submit }}
</form>

^{(This is just an example, you'll want to style it to fit your page.)}

None of your views will deal with the login form directly, so login_form and url_for_security aren't available while rendering most templates (this was causing the original issue you observed). Inject them for each request using app.context_processor.

from flask_security import LoginForm, url_for_security

@app.context_processor
def login_context():
    return {
        'url_for_security': url_for_security,
        'login_user_form': LoginForm(),
    }

To login with a name instead of an email address (using Flask-Security 1.7.0 or higher), you can replace the email field with a name field in the User model

class User(db.Model, UserMixin):
    id = db.Column(db.Integer, primary_key=True)
    name = db.Column(db.String(255), unique=True, index=True)
    password = db.Column(db.String(255))
    active = db.Column(db.Boolean())
    confirmed_at = db.Column(db.DateTime())
    roles = db.relationship('Role', secondary=roles_users,
                            backref=db.backref('users', lazy='dynamic'))

and update the app configuration.

app.config['SECURITY_USER_IDENTITY_ATTRIBUTES'] = 'name'

Next, to allow users to login using a name instead of an email, we will use the fact that the LoginForm validation method assumes the user identity attribute is in the email form field.

from flask_security.forms import LoginForm
from wtforms import StringField
from wtforms.validators import InputRequired

class ExtendedLoginForm(LoginForm):
    email = StringField('Username', [InputRequired()])

# Setup Flask-Security
user_datastore = SQLAlchemyUserDatastore(db, User, Role)
security = Security(app, user_datastore,
                    login_form=ExtendedLoginForm)

This way, we can login using a name without rewriting the validation method or the login template. Of course, this is a hack and the more correct approach would be to add a custom validate method (which checks a name form field) to the ExtendedLoginForm class and to update the login template accordingly (as done by Raja R above). Or even better, to replace the 'email' form field in 'LoginForm' with a 'user_identity' field and rewrite the validate method to accommodate any user identity field.

However, the approach above makes it easy to login with a name or an email address. To do this, define a user model with both a name and email field.

class User(db.Model, UserMixin):
    id = db.Column(db.Integer, primary_key=True)
    email = db.Column(db.String(255), unique=True)
    name = db.Column(db.String(255), unique=True, index=True)
    password = db.Column(db.String(255))
    active = db.Column(db.Boolean())
    confirmed_at = db.Column(db.DateTime())
    roles = db.relationship('Role', secondary=roles_users,
                            backref=db.backref('users', lazy='dynamic'))

and update the app configuration.

app.config['SECURITY_USER_IDENTITY_ATTRIBUTES'] = ('name','email')

Finally, create the custom login form.

from flask_security.forms import LoginForm
from wtforms import StringField
from wtforms.validators import InputRequired

class ExtendedLoginForm(LoginForm):
    email = StringField('Username or Email Address', [InputRequired()])

# Setup Flask-Security
user_datastore = SQLAlchemyUserDatastore(db, User, Role)
security = Security(app, user_datastore,
                    login_form=ExtendedLoginForm)

Now, when logging in, Flask-Security will accept an email or name in the email form field.

I think your best bet is just to copy flask_security's login form and view into your project, modify as necessary so you get the behaviour you want specific to the admin, and then register it as a separate endpoint/view. It can share the same blueprint you're using for your other admin views, and you can register your admin-specific context processor with that blueprint, so it only gets included where its needed. So all of flask_security continues to use the security.login endpoint, as well as the "public facing" login. Your admins, however, use your custom endpoint.

Example code (untested, there might be bugs, but hopefully it should get you close):

make a custom login form for the admin:

from flask_security.forms import LoginForm


class AdminLoginForm(LoginForm):
    """
    extend/override stuffs as necessary. this is a stock Flask-WTF form
    """

use it in your custom admin login view:

from flask import redirect, render_template, request
from flask_security.utils import login_user
from flask_security.views import after_this_request, _commit


@bp.route('/admin/login', endpoint='admin.login', methods=['GET', 'POST'])
def admin_login():
    form = AdminLoginForm(request.form)
    if form.validate_on_submit():
        login_user(form.user, remember=form.remember.data)
        
        # only necessay if you have `SECURITY_TRACKABLE = True` in your config
        after_this_request(_commit)
        
        return redirect(form.next.data or '/admin')

    return render_template('admin/login.html', form=form)

configure your admins to use it:

from flask import abort, redirect, request, url_for
from flask_admin import AdminIndexView, expose
from flask_admin.contrib.sqla import ModelView as BaseModelView
from flask_security import current_user
from http import HTTPStatus


class AdminSecurityMixin:
    def is_accessible(self):
        if (current_user.is_active  # is current_user account enabled?
                # are they logged in?
                and current_user.is_authenticated
                # do they have the correct roles to login to the admin?
                and current_user.has_role('ROLE_ADMIN')):
            return True
        return False

    def _handle_view(self, name, **kwargs):
        if not self.is_accessible():
            # if user is logged in, but can't view the admin, reject access
            if current_user.is_authenticated:
                abort(HTTPStatus.FORBIDDEN)
            # otherwise redirect to the admin login view
            # the next parameter is so we can redirect them after they'ved
            # logged in to where they wanted to go originally
            return redirect(url_for('admin.login', next=request.url))


class ModelView(AdminSecurityMixin, BaseModelView):
    """ 
    all your model admins should extend this base class, so that they are secured
    
    this is a great place to put other stuffs common to all your admins too
    """


class AdminDashboard(AdminSecurityMixin, AdminIndexView):
    @expose('/')
    def index(self):
        return self.render('admin/dashboard.html')

(probably those three admin classes shouldn't be in the same file, but, that's up to you. also, obviously I've left out the templates, but you'll need those too)

You don't need to define a new route for the registration.

In your signupform class that is inherited from RegisterForm you only need to override the validate method with your custom logic and return True or False as appropriate.

In your html template for registration the action url is {{ url_for_security('register') }}

The same applies for a custom login form - the url action though is {{ url_for_security('login') }}

I found the solution!!!

Views Flask-Security is packaged with a default template for each view it presents to a user. Templates are located within a sub-folder named security. The following is a list of view templates:

security/forgot_password.html
security/login_user.html
security/register_user.html
security/reset_password.html
security/change_password.html
security/send_confirmation.html
security/send_login.html

Overriding these templates is simple:

• Create a folder named security within your application’s templates folder
• Create a template with the same name for the template you wish to override

To login with a username instead of an email address (using Flask-Security 1.7.0 or higher), you can replace the email field with a username field in the User model

class User(db.Model, UserMixin):
    id = db.Column(db.Integer, primary_key=True)
    username = db.Column(db.String(255), unique=True, index=True)
    password = db.Column(db.String(255))
    active = db.Column(db.Boolean())
    confirmed_at = db.Column(db.DateTime())
    roles = db.relationship('Role', secondary=roles_users,
                            backref=db.backref('users', lazy='dynamic'))

and update the app configuration.

app.config['SECURITY_USER_IDENTITY_ATTRIBUTES'] = 'username'

Next, to allow users to login using a username instead of an email, we will use the fact that the LoginForm validation method assumes the user identity attribute is in the email form field.

from flask_security.forms import LoginForm
from wtforms import StringField
from wtforms.validators import InputRequired

class ExtendedLoginForm(LoginForm):
    email = StringField('Username', [InputRequired()])

# Setup Flask-Security
user_datastore = SQLAlchemyUserDatastore(db, User, Role)
security = Security(app, user_datastore,
                    login_form=ExtendedLoginForm)

This way, we can login using a username without rewriting the validation method or the login template. Of course, this is a hack and the more correct approach would be to add a custom validate method, which checks a username form field, to the ExtendedLoginForm class and to update the login template accordingly.

However, the approach above makes it easy to login with a username or an email address. To do this, define a user model with both a username and email field.

class User(db.Model, UserMixin):
    id = db.Column(db.Integer, primary_key=True)
    email = db.Column(db.String(255), unique=True)
    username = db.Column(db.String(255), unique=True, index=True)
    password = db.Column(db.String(255))
    active = db.Column(db.Boolean())
    confirmed_at = db.Column(db.DateTime())
    roles = db.relationship('Role', secondary=roles_users,
                            backref=db.backref('users', lazy='dynamic'))

and update the app configuration.

app.config['SECURITY_USER_IDENTITY_ATTRIBUTES'] = ('username','email')

Finally, create the custom login form.

from flask_security.forms import LoginForm
from wtforms import StringField
from wtforms.validators import InputRequired

class ExtendedLoginForm(LoginForm):
    email = StringField('Username or Email Address', [InputRequired()])

# Setup Flask-Security
user_datastore = SQLAlchemyUserDatastore(db, User, Role)
security = Security(app, user_datastore,
                    login_form=ExtendedLoginForm)

Now, when logging in, Flask-Security will accept an email or username in the email form field.