Файл: pyramid.pdf

41.1. AUTHENTICATION POLICIES

Default: /. The path for which the auth_tkt cookie is valid. May be desirable if the application only serves part of a domain. Optional.

http_only

Default: False. Hide cookie from JavaScript by setting the HttpOnly flag. Not honored by all browsers. Optional.

wild_domain

Default: True. An auth_tkt cookie will be generated for the wildcard domain. Optional.

debug

Default: False. If debug is True, log messages to the Pyramid debug logger about the results of various authentication steps. The output from debugging is useful for reporting to maillist or IRC channels when asking for support.

Objects of this class implement the interface described by pyramid.interfaces.IAuthenticationPolicy.

class RepozeWho1AuthenticationPolicy(identifier_name=’auth_tkt’, callback=None)

A Pyramid authentication policy which obtains data from the repoze.who 1.X WSGI ‘API’ (the repoze.who.identity key in the WSGI environment).

Constructor Arguments

identifier_name

Default: auth_tkt. The repoze.who plugin name that performs remember/forget. Optional.

callback

Default: None. A callback passed the repoze.who identity and the request, expected to return None if the user represented by the identity doesn’t exist or a sequence of principal identifiers (possibly empty) representing groups if the user does exist. If callback is None, the userid will be assumed to exist with no group principals.

Objects of this class implement the interface described by pyramid.interfaces.IAuthenticationPolicy.

511

41. PYRAMID.AUTHENTICATION

class RemoteUserAuthenticationPolicy(environ_key=’REMOTE_USER’, call-

back=None, debug=False)

A Pyramid authentication policy which obtains data from the REMOTE_USER WSGI environment variable.

Constructor Arguments

environ_key

Default: REMOTE_USER. The key in the WSGI environ which provides the userid.

callback

Default: None. A callback passed the userid and the request, expected to return None if the userid doesn’t exist or a sequence of principal identifiers (possibly empty) representing groups if the user does exist. If callback is None, the userid will be assumed to exist with no group principals.

debug

Default: False. If debug is True, log messages to the Pyramid debug logger about the results of various authentication steps. The output from debugging is useful for reporting to maillist or IRC channels when asking for support.

Objects of this class implement the interface described by pyramid.interfaces.IAuthenticationPolicy.

class SessionAuthenticationPolicy(prefix=’auth.’, callback=None, debug=False)

A Pyramid authentication policy which gets its data from the configured session. For this authentication policy to work, you will have to follow the instructions in the Sessions to configure a session factory.

Constructor Arguments

prefix

A prefix used when storing the authentication parameters in the session. Defaults to ‘auth.’. Optional.

callback

Default: None. A callback passed the userid and the request, expected to return None if the userid doesn’t exist or a sequence of principal identifiers (possibly empty) if the user does exist. If callback is None, the userid will be assumed to exist with no principals. Optional.

debug

Default: False. If debug is True, log messages to the Pyramid debug logger about the results of various authentication steps. The output from debugging is useful for reporting to maillist or IRC channels when asking for support.

512

41.2. HELPER CLASSES

41.2 Helper Classes

See pyramid.authentication.AuthTktAuthenticationPolicy for the meanings of the constructor arguments.

class AuthTicket(secret, userid, ip, tokens=(), user_data=’‘, time=None,

cookie_name=’auth_tkt’, secure=False)

This class represents an authentication token. You must pass in the shared secret, the userid, and the IP address. Optionally you can include tokens (a list of strings, representing role names), ‘user_data’, which is arbitrary data available for your own use in later scripts. Lastly, you can override the cookie name and timestamp.

Once you provide all the arguments, use .cookie_value() to generate the appropriate authentication ticket.

Usage:

token = AuthTicket(’sharedsecret’, ’username’, os.environ[’REMOTE_ADDR’], tokens=[’admin’])

val = token.cookie_value()

exception AuthTktCookieHelper.BadTicket(msg, expected=None)

Exception raised when a ticket can’t be parsed. If we get far enough to determine what the expected digest should have been, expected is set. This should not be shown by default, but can be useful for debugging.

AuthTktCookieHelper.forget(request)

Return a set of expires Set-Cookie headers, which will destroy any existing auth_tkt cookie when attached to a response

AuthTktCookieHelper.identify(request)

Return a dictionary with authentication information, or None if no valid auth_tkt is attached to request

513

41. PYRAMID.AUTHENTICATION

static AuthTktCookieHelper.parse_ticket(secret, ticket, ip)

Parse the ticket, returning (timestamp, userid, tokens, user_data).

If the ticket cannot be parsed, a BadTicket exception will be raised with an explanation.

AuthTktCookieHelper.remember(request, userid, max_age=None, to-

kens=())

Return a set of Set-Cookie headers; when set into a response, these headers will represent a valid authentication ticket.

max_age The max age of the auth_tkt cookie, in seconds. When this value is set, the cookie’s Max-Age and Expires settings will be set, allowing the auth_tkt cookie to last between browser sessions. If this value is None, the max_age value provided to the helper itself will be used as the max_age value. Default: None.

tokens A sequence of strings that will be placed into the auth_tkt tokens field. Each string in the sequence must be of the Python str type and must match the regex ^[A-Za-z][A-Za-z0-9+_-]*$. Tokens are available in the returned identity when an auth_tkt is found in the request and unpacked. Default:

().

514

CHAPTER

FORTYTWO

PYRAMID.CHAMELEON_TEXT

get_template(path)

Return the underyling object representing a Chameleon text template using the template implied by the path argument. The path argument may be a package-relative path, an absolute path, or a asset specification.

latex-warning.png

This API is deprecated in Pyramid 1.0. Use the implementation() method of a template renderer retrieved via pyramid.renderers.get_renderer() instead.

render_template(path, **kw)

Render a Chameleon text template using the template implied by the path argument. The path argument may be a package-relative path, an absolute path, or a asset specification. The arguments in *kw are passed as top-level names to the template, and so may be used within the template itself. Returns a string.

latex-warning.png

This API is deprecated in Pyramid 1.0. Use pyramid.renderers.render() instead.

515

42. PYRAMID.CHAMELEON_TEXT

render_template_to_response(path, **kw)

Render a Chameleon text template using the template implied by the path argument. The path argument may be a package-relative path, an absolute path, or a asset specification. The arguments in *kw are passed as top-level names to the template, and so may be used within the template itself. Returns a Response object with the body as the template result.

latex-warning.png

This API is deprecated in Pyramid 1.0. Use pyramid.renderers.render_to_response() instead.

These APIs will will work against template files which contain simple ${Genshi} - style replacement markers.

The API of pyramid.chameleon_text is identical to that of pyramid.chameleon_zpt; only its import location is different. If you need to import an API functions from this module as well as the pyramid.chameleon_zpt module within the same view file, use the as feature of the Python import statement, e.g.:

516