def unsign(self, signature, url):
        """
        Return a user object for a valid signature.
        """
        User = get_user_model()
        data = signing.loads(signature, salt=self.get_salt(url), max_age=self.MAX_AGE)

        if not isinstance(data, dict):
            raise signing.BadSignature()

        try:
            return User.objects.get(
                **{"pk": data.get("user_id"), User.USERNAME_FIELD: data.get("username")}
            )
        except User.DoesNotExist:
            raise signing.BadSignature()

        Return a user object for a valid signature.
        
cvat/apps/iam/authentication.py