Access Control using Guard

Restish supplies a module called guard which makes applying access control easy to apply to

Basic Auth using repoze.who

A short example of implementing repoze.who as a guard using htpasswd files and basic http authentication.

Add the repoze line to the <project>.ini file

[app:projectname]
use = egg:projectname
cache_dir = %(CACHE_DIR)s
repoze.who.ini = %(here)s/who.ini

Add the repoze middle ware by adding these lines to wsgiapp.py

import repoze.who.config
...
def make_app(global_conf, **app_conf):
    app = RestishApp(root.Root())
    app = repoze.who.config.make_middleware_with_config(app, global_conf, local_conf['who.ini'])
    app = setup_environ(app, global_conf, app_conf)
    return app

The default restish guard in {projectname}/lib includes an authenticated decorator that checks for a REMOTE_USER cookie. We can use this to decorate children or accept headers.

class Root(resource.Resource):

    @resource.GET()
    @guard.guard(guard.authenticated)
    def html(self, request):
        return http.ok([('Content-Type', 'text/html')],
            "<p>Hello from foo!</p>")

All that is left to do now is to configure repoze by creating a who.ini file..

The most basic configuration is ‘basicauth’ and ‘htpasswd’. The configuration for this is shown below.

[general]
request_classifier = repoze.who.classifiers:default_request_classifier
challenge_decider = repoze.who.classifiers:default_challenge_decider

[identifiers]
plugins = basicauth

[authenticators]
plugins = htpasswd

[challengers]
plugins = basicauth

[plugin:basicauth]
use = repoze.who.plugins.basicauth:make_plugin
realm = 'sample'

[plugin:htpasswd]
use = repoze.who.plugins.htpasswd:make_plugin
filename = %(here)s/passwd
check_fn = repoze.who.plugins.htpasswd:crypt_check

The [general] block just sets up default classifiers and deciders which categorise the request type and decide which challenge to use (read the repoze.who docs to learn more).

A list of prioritised plugins for each section need to be given and in this case basicauth can be used as an identifier and a challenger which needs configuring with a realm. We’re using htpasswd for the authenticator which needs a filename configuring and a check function (which we’re defaulting to the built in).

All that is left is to create a passwd file using htpasswd

htpasswd -c passwd <username>

and you should now be able to run your project server and get a http challenge asking for username and password.