Authentication - Revision history

Rodney757: /* basic_auth: */

2013-05-06T14:25:03Z

basic_auth:

← Older revision		Revision as of 14:25, 6 May 2013
Line 141:		Line 141:

	Would remove pw_hash from User model. Reason is if someone would like to have the only way to login to an account is with OpenID or Persona. We would still require every account to have a unique username regardless of the Authentication enabled, thus username will be left in the User model. Email would be left in the User model for the same reason as username.		Would remove pw_hash from User model. Reason is if someone would like to have the only way to login to an account is with OpenID or Persona. We would still require every account to have a unique username regardless of the Authentication enabled, thus username will be left in the User model. Email would be left in the User model for the same reason as username.

	===basic_auth:===

	pw_hash = Column(Unicode, nullable=False)

	user = Column(Integer, ForeignKey(User.id), nullable=False)

	===OpenID/Persona:===		===OpenID/Persona:===

Rodney757: /* Proposed DB Schema */

2013-05-06T00:45:42Z

Proposed DB Schema

← Older revision		Revision as of 00:45, 6 May 2013
Line 140:		Line 140:
	== Proposed DB Schema ==		== Proposed DB Schema ==

			Would remove pw_hash from User model. Reason is if someone would like to have the only way to login to an account is with OpenID or Persona. We would still require every account to have a unique username regardless of the Authentication enabled, thus username will be left in the User model. Email would be left in the User model for the same reason as username.
⚫	===basic_auth===

		⚫	===basic_auth:===

		⚫	pw_hash = Column(Unicode, nullable=False)

⚫	pw_hash = Column(Unicode, nullable=False)
	user = Column(Integer, ForeignKey(User.id), nullable=False)		user = Column(Integer, ForeignKey(User.id), nullable=False)

	===~~openid~~/~~persona~~===		===OpenID/Persona:===

			openid_url = Column(unicode, nullable=False)

			user = Column(Integer, ForeignKey(User,id), nullable=False)

	== __init__.py Base Class ==		== __init__.py Base Class ==

Rodney757: /* basic_auth */

2013-05-06T00:31:30Z

basic_auth

← Older revision		Revision as of 00:31, 6 May 2013
Line 141:		Line 141:

	===basic_auth===		===basic_auth===

			pw_hash = Column(Unicode, nullable=False)
			user = Column(Integer, ForeignKey(User.id), nullable=False)

	===openid/persona===		===openid/persona===

Rodney757: /* init.py Base Class */

2013-05-06T00:16:58Z

__init__.py Base Class

← Older revision		Revision as of 00:16, 6 May 2013
Line 137:		Line 137:
	add_classy_hooks(ldap, ['check_login'])		add_classy_hooks(ldap, ['check_login'])
	...</nowiki>		...</nowiki>

			== Proposed DB Schema ==

			===basic_auth===

			===openid/persona===

	== __init__.py Base Class ==		== __init__.py Base Class ==

Rodney757: /* init.py Base Class */

2013-05-03T16:12:49Z

__init__.py Base Class

@@ Line 113: / Line 113: @@
 * No straight way of doing multiple instances.
 *: Yes, the individual hook could do it by itself
 == __init__.py Base Class ==

Rodney757: /* Non-Interfacey Design w/ hooks for every call: */

2013-05-03T14:23:03Z

Non-Interfacey Design w/ hooks for every call:

← Older revision		Revision as of 14:23, 3 May 2013
Line 71:		Line 71:

	===Non-Interfacey Design w/ hooks for every call:===		===Non-Interfacey Design w/ hooks for every call:===

			This is the way we are going to implement auth plugins.

	This design would have a plugin "template" in auth/__init__.py similar to the Interfacey designs, except that it would use hook_handle() for each function.		This design would have a plugin "template" in auth/__init__.py similar to the Interfacey designs, except that it would use hook_handle() for each function.

	Ex.		Ex.
	~~auth/__init__~~.py:<nowiki>		mediagoblin.ini:<nowiki>
			[plugins]
			[[plugins.ldap]]
			[[[server1]]]
			[[[server2]]]

			auth/__init__.py:
	def check_login(user, Password):		def check_login(user, Password):
	return hook_handle("auth_check_login", user, password)		return hook_handle("auth_check_login", user, password)

	auth_plugin/__init__.py:		auth_plugin/__init__.py:
			...
	hooks = {"auth_check_login": check_login}		hooks = {"auth_check_login": check_login}
			# or depending on the plugin
			def setup_plugin():
			serv1 = ldap_thing(config1)
			serv2 = ldap_thing(config2)
			pluginapi.add_hook("check_login", serv1.check_login)
			pluginapi.add_hook("check_login", serv2.check_login)
			...

	def check_login(user, password):		def check_login(user, password):
	if a: return True # Yes, let them in		if a: return True # Yes, let them in

Cwebber at 20:52, 2 May 2013

2013-05-02T20:52:00Z

← Older revision		Revision as of 20:52, 2 May 2013
Line 1:		Line 1:
			== Different use cases for different login systems ==

			Different login systems may affect the way auth stuff works differently. For example, all of these cases are very different, but all fall under the "auth world view":

			* You log in via some central auth system thing that uses the mediagoblin login page interface, but passes off the username/password to some other database. (If that username and password exist remotely, do we need to "give" that username to a newly created user?)
			* Persona/OpenID style: You have a user, but you have the option to log in the user via some external page and then come back. In this case, we're probably not creating new users on-demand, and we don't really use the login page at all anyway.

	== Designing Authentication API ==		== Designing Authentication API ==

Rodney757: /* Non-Interfacey Design w/ hooks for every call: */

2013-05-02T20:10:07Z

Non-Interfacey Design w/ hooks for every call:

← Older revision		Revision as of 20:10, 2 May 2013
Line 70:		Line 70:
	auth/__init__.py:<nowiki>		auth/__init__.py:<nowiki>
	def check_login(user, Password):		def check_login(user, Password):
	return hook_handle("auth_check_login", user, password)~~</nowiki>~~		return hook_handle("auth_check_login", user, password)

	auth_plugin/__init__.py:~~<nowiki>~~		auth_plugin/__init__.py:
	hooks = {"auth_check_login": check_login}		hooks = {"auth_check_login": check_login}
	def check_login(user, password):		def check_login(user, password):

Rodney757: /* Interfacey Design w/ hooks: */

2013-05-02T20:09:39Z

Interfacey Design w/ hooks:

← Older revision		Revision as of 20:09, 2 May 2013
Line 51:		Line 51:
	...		...

	auth_plugin/__init__.py:~~<nowiki>~~		auth_plugin/__init__.py:
	hooks = {"auth_provider": get_auth_provider}		hooks = {"auth_provider": get_auth_provider}
	def get_auth_provider(): return AuthUserInterface()</nowiki>		def get_auth_provider(): return AuthUserInterface()</nowiki>

Rodney757: /* Interfacey Design w/o hooks: */

2013-05-02T20:08:51Z

Interfacey Design w/o hooks:

← Older revision		Revision as of 20:08, 2 May 2013
Line 25:		Line 25:
	return get_response("check_login", user, password)		return get_response("check_login", user, password)

	auth_plugin/__init__.py:~~<nowiki>~~		auth_plugin/__init__.py:
	def setup_plugin():		def setup_plugin():
	add_auth_provider(SomeAuthPlugin(config1))		add_auth_provider(SomeAuthPlugin(config1))

Authentication - Revision history

Rodney757: /* basic_auth: */

Rodney757: /* Proposed DB Schema */

Rodney757: /* basic_auth */

Rodney757: /* __init__.py Base Class */

Rodney757: /* __init__.py Base Class */

Rodney757: /* Non-Interfacey Design w/ hooks for every call: */

Cwebber at 20:52, 2 May 2013

Rodney757: /* Non-Interfacey Design w/ hooks for every call: */

Rodney757: /* Interfacey Design w/ hooks: */

Rodney757: /* Interfacey Design w/o hooks: */

Rodney757: /* init.py Base Class */

Rodney757: /* init.py Base Class */