Warning: Can't synchronize with repository "(default)" (Unsupported version control system "svn": No module named svn). Look in the Trac log for more information.

Ticket #11 (closed defect: fixed)

Opened 9 years ago

Last modified 7 years ago

Simple authentication/authorization framework

Reported by: kevin Owned by: anonymous
Priority: normal Milestone: 0.9
Component: TurboGears Version:
Severity: normal Keywords:
Cc:

Description (last modified by kevin) (diff)

Authentication and authorization are needed for almost any non-trivial application. The trouble is that many people have different needs. TurboGears Auth/Auth? should have the following features:

  • an SQLObject data model that handles users with roles and mappings from roles to permissions
  • ability to use other data models/protocols (none need to be implemented... it just needs to be possible)
  • ability to use basic or cookie auth with a login screen
  • no use of session variables
  • ability to require authentication for part of the site
  • ability to require authentication for a single method

A separate ticket will cover creating a basic administration interface for users.

It will be good to look at work already done, particularly in the context of CherryPy?. The best known work on auth in CherryPy? appears to be  MultiAuth.

 PyProtocols may be an important part of this in a couple of ways: 1) it will make it easier to adapt someone's data model to whatever is needed for TurboGears auth, 2) the generic function dispatch functionality can be very useful for setting up more complicated rules. Phillip Eby has done a lot of work on PEAK authentication, so it's worth looking at for ideas if nothing else.

Change History

comment:1 Changed 9 years ago by kevin

  • Description modified (diff)

comment:2 Changed 9 years ago by Lafriks

I would still like to see posibility to set auth to use session variable(s).

comment:3 Changed 9 years ago by kevin

  • Milestone set to 0.9

comment:4 Changed 9 years ago by kevin

  • Status changed from new to closed
  • Resolution set to fixed

Jeff Watkins' identity framework is in place in svn now. I'm going to close this ticket. Any other issues remaining with identity should be in separate tickets.

Note: See TracTickets for help on using tickets.