# AMP Authentication

## Overview

`epsilon.ampauth` integrates Twisted Cred with `twisted.protocols.amp`, providing support for selecting a `IBoxReceiver` based on the result of a Cred login.

Readers should familiarize themselves with the following concepts in order to understand all sections of this document:

- Twisted TCP clients and TCP servers
- Using Deferreds
- Twisted `AMP`
- Twisted Cred

## Servers

`CredAMPServerFactory` is a factory for the `CredReceiver` protocol, an `AMP` subclass which implements responders for commands which allow a client to prove their identity. It uses a `Portal` to handle these commands and retrieve an `IBoxReceiver` which will be used to handle all further AMP boxes it receives.

AMP server with authentication

`Add` and `Adder` together define a simple AMP protocol for adding two integers together. `AdditionRealm` provides the necessary integration between this AMP protocol and Cred, creating new `Adder` instances whenever an `IBoxReceiver` is requested - which will be whenever a client attempts to authenticate itself to the server.

## Clients

AMP clients can authenticate with an AMP server using `login`. `login` takes a connected AMP instance and a credentials object as arguments and returns a `Deferred` which fires when authentication finishes.

Authenticating AMP client

The TCP connection is set up as usual, and the `Add` command is also issued in the usual way. The only change from a normal AMP client is the use of `login` after a connection has been set up but before any commands are issued.

## One-Time Pad Authentication

`epsilon.ampauth` includes an `CredentialsChecker` for validating one-time pads: `OneTimePadChecker`. If this checker is registered with the portal, clients may use the `OTPLogin` command to authenticate.

AMP server with OTP authentication

OTP-authenticating AMP client