Access Control using Guard — Restish v0.7.1 documentation

### Navigation

- index
- modules |
- next |
- previous |
- Restish v0.7.1 documentation »

Overview

# Access Control using Guard

Restish supplies a module called `guard` which makes applying access control easy to apply to

## Basic Auth using repoze.who

A short example of implementing repoze.who as a guard using htpasswd files and basic http authentication.

Add the repoze line to the <project>.ini file

    [app:projectname]
    use = egg:projectname
    cache_dir = %(CACHE_DIR)s
    repoze.who.ini = %(here)s/who.ini

Add the repoze middle ware by adding these lines to wsgiapp.py

    import repoze.who.config
    ...
    def make_app(global_conf, **app_conf):
        app = RestishApp(root.Root())
        app = repoze.who.config.make_middleware_with_config(app, global_conf, local_conf['who.ini'])
        app = setup_environ(app, global_conf, app_conf)
        return app

The default restish guard in `{projectname}/lib` includes an `authenticated` decorator that checks for a `REMOTE_USER` cookie. We can use this to decorate children or accept headers.

    class Root(resource.Resource):

        @resource.GET()
        @guard.guard(guard.authenticated)
        def html(self, request):
            return http.ok([('Content-Type', 'text/html')],
                "<p>Hello from foo!</p>")

All that is left to do now is to configure repoze by creating a `who.ini` file..

The most basic configuration is ‘basicauth’ and ‘htpasswd’. The configuration for this is shown below.

    [general]
    request_classifier = repoze.who.classifiers:default_request_classifier
    challenge_decider = repoze.who.classifiers:default_challenge_decider

    [identifiers]
    plugins = basicauth

    [authenticators]
    plugins = htpasswd

    [challengers]
    plugins = basicauth

    [plugin:basicauth]
    use = repoze.who.plugins.basicauth:make_plugin
    realm = 'sample'

    [plugin:htpasswd]
    use = repoze.who.plugins.htpasswd:make_plugin
    filename = %(here)s/passwd
    check_fn = repoze.who.plugins.htpasswd:crypt_check

The `[general]` block just sets up default classifiers and deciders which categorise the request type and decide which challenge to use (read the repoze.who docs to learn more).

A list of prioritised plugins for each section need to be given and in this case basicauth can be used as an identifier and a challenger which needs configuring with a `realm`. We’re using htpasswd for the authenticator which needs a filename configuring and a check function (which we’re defaulting to the built in).

All that is left is to create a `passwd` file using `htpasswd`

    htpasswd -c passwd <username>

and you should now be able to run your project server and get a http challenge asking for username and password.

### Navigation

- index
- modules |
- next |
- previous |
- Restish v0.7.1 documentation »