diff --git a/requirements-swh.txt b/requirements-swh.txt
--- a/requirements-swh.txt
+++ b/requirements-swh.txt
@@ -1,3 +1,4 @@
+swh.auth >= 0.3.4
 swh.core >= 0.0.95
 swh.indexer >= 0.4.1
 swh.model >= 0.5.0
diff --git a/swh/web/auth/migrations/0003_delete_oidcuser.py b/swh/web/auth/migrations/0003_delete_oidcuser.py
new file mode 100644
--- /dev/null
+++ b/swh/web/auth/migrations/0003_delete_oidcuser.py
@@ -0,0 +1,14 @@
+# Generated by Django 2.2.19 on 2021-03-22 15:41
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("swh_web_auth", "0002_remove_stored_tokens"),
+    ]
+
+    operations = [
+        migrations.DeleteModel(name="OIDCUser",),
+    ]
diff --git a/swh/web/auth/models.py b/swh/web/auth/models.py
--- a/swh/web/auth/models.py
+++ b/swh/web/auth/models.py
@@ -3,14 +3,12 @@
 # License: GNU Affero General Public License version 3, or any later version
 # See top-level LICENSE file for more information
 
-from datetime import datetime
-from typing import Optional, Set
-
-from django.contrib.auth.models import User
 from django.db import models
 
+from swh.auth.django.models import OIDCUser as OIDCUserBase
+
 
-class OIDCUser(User):
+class OIDCUser(OIDCUserBase):
     """
     Custom User proxy model for remote users storing OpenID Connect
     related data: profile containing authentication tokens.
@@ -19,66 +17,10 @@
     in the Keycloak one.
     """
 
-    # OIDC subject identifier
-    sub: str = ""
-
-    # OIDC tokens and session related data, only relevant when a user
-    # authenticates from a web browser
-    access_token: Optional[str] = None
-    expires_at: Optional[datetime] = None
-    id_token: Optional[str] = None
-    refresh_token: Optional[str] = None
-    refresh_expires_at: Optional[datetime] = None
-    scope: Optional[str] = None
-    session_state: Optional[str] = None
-
-    # User permissions
-    permissions: Set[str]
-
     class Meta:
         app_label = "swh_web_auth"
         proxy = True
-
-    def save(self, **kwargs):
-        """
-        Override django.db.models.Model.save to avoid saving the remote
-        users to web application database.
-        """
-        pass
-
-    def get_group_permissions(self, obj=None) -> Set[str]:
-        """
-        Override django.contrib.auth.models.PermissionsMixin.get_group_permissions
-        to get permissions from OIDC
-        """
-        return self.get_all_permissions(obj)
-
-    def get_all_permissions(self, obj=None) -> Set[str]:
-        """
-        Override django.contrib.auth.models.PermissionsMixin.get_all_permissions
-        to get permissions from OIDC
-        """
-        return self.permissions
-
-    def has_perm(self, perm, obj=None) -> bool:
-        """
-        Override django.contrib.auth.models.PermissionsMixin.has_perm
-        to check permission from OIDC
-        """
-        if self.is_active and self.is_superuser:
-            return True
-
-        return perm in self.permissions
-
-    def has_module_perms(self, app_label) -> bool:
-        """
-        Override django.contrib.auth.models.PermissionsMixin.has_module_perms
-        to check permissions from OIDC.
-        """
-        if self.is_active and self.is_superuser:
-            return True
-
-        return any(perm.startswith(app_label) for perm in self.permissions)
+        auto_created = True  # prevent model to be created in database by migrations
 
 
 class OIDCUserOfflineTokens(models.Model):