def users_feature(app):
    if not app.config.get('USER_JWT_SECRET', None):
        raise x.JwtSecretMissing('Please set USER_JWT_SECRET in config')
    app.session_interface = BoilerSessionInterface()
    user_service.init(app)
    login_manager.init_app(app)
    login_manager.login_view = 'user.login'
    login_manager.login_message = None
    @login_manager.user_loader
    def load_user(id):
        return user_service.get(id)
    oauth.init_app(app)
    registry = OauthProviders(app)
    providers = registry.get_providers()
    with app.app_context():
        for provider in providers:
            if provider not in oauth.remote_apps:
                oauth.remote_app(provider, **providers[provider])
                registry.register_token_getter(provider)
    principal.init_app(app)
    @principal.identity_loader
    def load_identity():
        if current_user.is_authenticated:
            return Identity(current_user.id)
        session.pop('identity.name', None)
        session.pop('identity.auth_type', None)
        return AnonymousIdentity()
    @identity_loaded.connect_via(app)
    def on_identity_loaded(sender, identity):
        identity.user = current_user
        if not current_user.is_authenticated:
            return
        identity.provides.add(UserNeed(current_user.id))
        for role in current_user.roles:
            identity.provides.add(RoleNeed(role.handle))