Файл: pyramid.pdf

$ cd ~/modwsgi/env

$chmod 755 pyramid.wsgi

9.Edit your Apache configuration and add some stuff. I happened to create a file named /etc/apache2/other/modwsgi.conf on my own system while installing Apache, so this stuff went in there.

#Use only 1 Python sub-interpreter. Multiple sub-interpreters

#play badly with C extensions.

WSGIApplicationGroup %{GLOBAL} WSGIPassAuthorization On

WSGIDaemonProcess pyramid user=chrism group=staff threads=4 \ python-path=/Users/chrism/modwsgi/env/lib/python2.6/site-packages

WSGIScriptAlias /myapp /Users/chrism/modwsgi/env/pyramid.wsgi

<Directory /Users/chrism/modwsgi/env> WSGIProcessGroup pyramid

Order allow,deny Allow from all

</Directory>

10. Restart Apache

$sudo /usr/sbin/apachectl restart

11.Visit http://localhost/myapp in a browser. You should see the sample application rendered in your browser.

mod_wsgi has many knobs and a great variety of deployment modes. This is just one representation of how you might use it to serve up a Pyramid application. See the mod_wsgi configuration documentation for more in-depth configuration information.

503

39. RUNNING A PYRAMID APPLICATION UNDER MOD_WSGI

504

CHAPTER

FORTY

PYRAMID.AUTHORIZATION

class ACLAuthorizationPolicy

An authorization policy which consults an ACL object attached to a context to determine authorization information about a principal or multiple principals. If the context is part of a lineage, the context’s parents are consulted for ACL information too. The following is true about this security policy.

•When checking whether the ‘current’ user is permitted (via the permits method), the security policy consults the context for an ACL first. If no ACL exists on the context, or one does exist but the ACL does not explicitly allow or deny access for any of the effective principals, consult the context’s parent ACL, and so on, until the lineage is exhausted or we determine that the policy permits or denies.

pyramid.security.ACLDenied instance (equals False) immediately. If any pyramid.security.Allow ACE is found matching any principal, stop processing by returning an pyramid.security.ACLAllowed instance (equals True) immediately. If we exhaust the context’s lineage, and no ACE has explicitly permitted or denied access, return an instance of pyramid.security.ACLDenied (equals False).

•When computing principals allowed by a permission via the pyramid.security.principals_allowed_by_permission() method, we compute the set of principals that are explicitly granted the permission in the provided context. We do this by walking ‘up’ the object graph from the root to the context. During this walking process, if we find an explicit pyramid.security.Allow ACE for a principal that matches the permission, the principal is included in the allow list. However, if later in the walking process that principal is mentioned

507

40. PYRAMID.AUTHORIZATION

in any pyramid.security.Deny ACE for the permission, the principal is removed from the allow list. If a pyramid.security.Deny to the principal pyramid.security.Everyone is encountered during the walking process that matches the permission, the allow list is cleared for all principals encountered in previous ACLs. The walking process ends after we’ve processed the any ACL directly attached to context; a set of principals is returned.

Objects of this class implement the pyramid.interfaces.IAuthorizationPolicy interface.

508

CHAPTER

FORTYONE

PYRAMID.AUTHENTICATION

41.1 Authentication Policies

class AuthTktAuthenticationPolicy(secret, callback=None, cookie_name=’auth_tkt’, secure=False, include_ip=False, timeout=None, reissue_time=None, max_age=None, path=’/’, http_only=False, wild_domain=True, de-

bug=False)

A Pyramid authentication policy which obtains data from a Pyramid “auth ticket” cookie.

Constructor Arguments

secret

The secret (a string) used for auth_tkt cookie signing. Required.

callback

Default: None. A callback passed the userid and the request, expected to return None if the userid doesn’t exist or a sequence of principal identifiers (possibly empty) if the user does exist. If callback is None, the userid will be assumed to exist with no principals. Optional.

cookie_name

Default: auth_tkt. The cookie name used (string). Optional.

509

41. PYRAMID.AUTHENTICATION

secure

Default: False. Only send the cookie back over a secure conn. Optional.

include_ip

Default: False. Make the requesting IP address part of the authentication data in the cookie. Optional.

timeout

Default: None. Maximum number of seconds which a newly issued ticket will be considered valid. After this amount of time, the ticket will expire (effectively logging the user out). If this value is None, the ticket never expires. Optional.

reissue_time

Default: None. If this parameter is set, it represents the number of seconds that must pass before an authentication token cookie is automatically reissued as the result of a request which requires authentication. The duration is measured as the number of seconds since the last auth_tkt cookie was issued and ‘now’. If this value is 0, a new ticket cookie will be reissued on every request which requires authentication.

A good rule of thumb: if you want auto-expired cookies based on inactivity: set the timeout value to 1200 (20 mins) and set the reissue_time value to perhaps a tenth of the timeout value (120 or 2 mins). It’s nonsensical to set the timeout value lower than the reissue_time value, as the ticket will never be reissued if so. However, such a configuration is not explicitly prevented.

Optional.

max_age

Default: None. The max age of the auth_tkt cookie, in seconds. This differs from timeout inasmuch as timeout represents the lifetime of the ticket contained in the cookie, while this value represents the lifetime of the cookie itself. When this value is set, the cookie’s Max-Age and Expires settings will be set, allowing the auth_tkt cookie to last between browser sessions. It is typically nonsensical to set this to a value that is lower than timeout or reissue_time, although it is not explicitly prevented. Optional.

path

510