In general, they are all similar but some of them have more features than other. For example, Flask-Security is very heavy with lots of extra security features like encryption extra. In fact, Flask-Security includes Flask-Principal as a subset. Flask-Principal can use Flask-Login for auth even though that is just one option. So you can see that they are all related but some are subsets or supersets of each other.
Now in your specific case, you are already using Flask-Login which is excellent. If you need to add user roles which Flask-Login does not support, I recommend you extend your User Model to add a Roles column and then overwrite the login_required decorator. If you try to use the extensions like Flask-Security etc, it might be overkill in your situation.
As example, I will extend my User class with a role field. It can have values "ANY", "ADMIN" etc. ANY means does not matter.
class User(UserMixin):
def get_role():
return rolename
I will then overwrite the login_required decorator as:
def login_required(role="ANY"):
def wrapper(fn):
@wraps(fn)
def decorated_view(*args, **kwargs):
if not current_user.is_authenticated():
return current_app.login_manager.unauthorized()
urole = current_user.get_role()
if ( (urole != role) and (role != "ANY")):
logout_user()
return current_app.login_manager.unauthorized()
return fn(*args, **kwargs)
return decorated_view
return wrapper
