Re: refreshing of basic_auth.users possible?

--000000000000971b0305935f390c
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi Peter!

FYI basic_auth and digest_auth are deprecated and were removed over a year
ago <http://docs.cherrypy.org/en/latest/history.html#v16-0-0>. You should
instead adapt to use the more recent and better implemented auth_basic and
auth_digest <http://docs.cherrypy.org/en/latest/history.html#v14-0-0>.
So auth_basic in fact supports a checkpassword setting which is a callable:
https://docs.cherrypy.org/en/latest/basics.html?highlight=3Dauth_basic#basi=
c.

Also, I'd like to point out two more things:
1) It's more secure to prefer digest auth over basic. auth_digest also
supports a callable setting (get_ha1):
https://github.com/cherrypy/cherrypy/blob/v18.2.0/cherrypy/lib/auth_digest.=
py#L16
2) Don't forget that you can easily customize things by writing your own
tools and/or plugins:
https://docs.cherrypy.org/en/latest/extend.html#per-request-functions

=D1=81=D1=80, 25 =D0=B2=D0=B5=D1=80. 2019 =D0=BE 08:50 Peter C. Miller <pet=
[email protected]> =D0=BF=D0=B8=D1=88=D0=B5:

> I have user auth working well in cherrypy with code below.
>
> The problem I'm having is that if the target database of users gets
> updated - e.g. user adds or updates a password, cherrypy doesn't seem to
> know about it because it only brings in the data once at launch via below
> 'get_users()' method. the get_users simply returns a manual key value dic=
t
> scraped form a pymongo_db.
>
> Restarting cherrpy 'solves' the problem, but obviously realtime connectio=
n
> or update is needed.
>
> I've tried setting basic_auth.users to just method name rather than the
> data coming from an actual call, and also best guesses at cherrypy config
> update calls, but no joy.
>
> Can't find update examples either.
>
> No luck with direct setting to pymongo db either.
>
> Would greatly appreciate it if anyone out there has some pointers.
>
> auth_users_config =3D {
>     'tools.basic_auth.on': True,
>     'tools.basic_auth.users': get_users(),
>     'tools.basic_auth.realm': 'some.place.out.there',
>     'tools.basic_auth.encrypt': pwe
> }
>
> .....
>
> sslConfig =3D {
>     # Users access:
>     '/ExternalResource': auth_users_config,
>
> .....
>
> https_cp_app =3D cherrypy.tree.mount(api_sub_domain_container.dev,
>                                                '/a_mount',
>                                                sslConfig)
>
> --
> You received this message because you are subscribed to the Google Groups
> "cherrypy-users" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to cherrypy-users+unsubscribe-/JYPxA39Uh5TLH3MbocFF+G/[email protected]
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/cherrypy-users/1acd7645-3603-4179-9d9f-=
4a882d9efee2%40googlegroups.com
> <https://groups.google.com/d/msgid/cherrypy-users/1acd7645-3603-4179-9d9f=
-4a882d9efee2%40googlegroups.com?utm_medium=3Demail&utm_source=3Dfooter>
> .
>


--=20
Cheers,
Sviatoslav.

--=20
You received this message because you are subscribed to the Google Groups "=
cherrypy-users" group.
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to cherrypy-users+unsubscribe-/JYPxA39Uh5TLH3MbocFF+G/[email protected]
To view this discussion on the web visit https://groups.google.com/d/msgid/=
cherrypy-users/CAFYONRCBkuGXcka34jWwAe4WPuKE0oWoj6v_GGS_m0US4z%3DJoA%40mail=
.gmail.com.

--000000000000971b0305935f390c
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Hi Peter!</div><div><br></div>FYI=C2=A0<font face=3D"=
monospace">basic_auth</font> and <font face=3D"monospace">digest_auth</font=
> are deprecated and were removed <a href=3D"http://docs.cherrypy.org/en/la=
test/history.html#v16-0-0">over a year ago</a>. You should instead <a href=
=3D"http://docs.cherrypy.org/en/latest/history.html#v14-0-0">adapt to use t=
he more recent and better implemented=C2=A0<font face=3D"monospace">auth_ba=
sic</font> and <font face=3D"monospace">auth_digest</font></a>.<div>So <fon=
t face=3D"monospace">auth_basic</font> in fact supports a <font face=3D"mon=
ospace">checkpassword</font> setting which is a callable:=C2=A0<a href=3D"h=
ttps://docs.cherrypy.org/en/latest/basics.html?highlight=3Dauth_basic#basic=
">https://docs.cherrypy.org/en/latest/basics.html?highlight=3D<font face=3D=
"monospace">auth_basic</font>#basic</a>.</div><div><br></div><div>Also, I&#=
39;d like to point out two more things:</div><div>1) It&#39;s more secure t=
o prefer digest auth over basic.=C2=A0<font face=3D"monospace">auth_digest<=
/font> also supports a callable setting (<font face=3D"monospace">get_ha1</=
font>):=C2=A0<a href=3D"https://github.com/cherrypy/cherrypy/blob/v18.2.0/c=
herrypy/lib/auth_digest.py#L16">https://github.com/cherrypy/cherrypy/blob/v=
18.2.0/cherrypy/lib/auth_digest.py#L16</a></div><div>2) Don&#39;t forget th=
at you can easily customize things by writing your own tools and/or plugins=
: <a href=3D"https://docs.cherrypy.org/en/latest/extend.html#per-request-fu=
nctions">https://docs.cherrypy.org/en/latest/extend.html#per-request-functi=
ons</a></div></div><br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D=
"gmail_attr">=D1=81=D1=80, 25 =D0=B2=D0=B5=D1=80. 2019 =D0=BE 08:50 Peter C=
. Miller &lt;<a href=3D"mailto:[email protected]">[email protected]=
</a>&gt; =D0=BF=D0=B8=D1=88=D0=B5:<br></div><blockquote class=3D"gmail_quot=
e" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204)=
;padding-left:1ex"><div dir=3D"ltr">I have user auth working well in cherry=
py with code below. <br><br>The problem I&#39;m having is that if the targe=
t database of users gets updated - e.g. user adds or updates a password, ch=
errypy doesn&#39;t seem to know about it because it only brings in the data=
 once at launch via below &#39;get_users()&#39; method. the get_users simpl=
y returns a manual key value dict scraped form a pymongo_db.<br><br>Restart=
ing cherrpy &#39;solves&#39; the problem, but obviously realtime connection=
 or update is needed.<br><br>I&#39;ve tried setting basic_auth.users to jus=
t method name rather than the data coming from an actual call, and also bes=
t guesses at cherrypy config update calls, but no joy. <br><br>Can&#39;t fi=
nd update examples either. <br><br>No luck with direct setting to pymongo d=
b either.<br><br>Would greatly appreciate it if anyone out there has some p=
ointers.<br><br>auth_users_config =3D {<br>=C2=A0=C2=A0=C2=A0 &#39;tools.ba=
sic_auth.on&#39;: True,<br>=C2=A0=C2=A0=C2=A0 &#39;tools.basic_auth.users&#=
39;: get_users(), <br>=C2=A0=C2=A0=C2=A0 &#39;tools.basic_auth.realm&#39;: =
&#39;some.place.out.there&#39;,<br>=C2=A0=C2=A0=C2=A0 &#39;tools.basic_auth=
.encrypt&#39;: pwe<br>}<br><br>.....<br><br>sslConfig =3D {<br>=C2=A0=C2=A0=
=C2=A0 # Users access:<br>=C2=A0=C2=A0=C2=A0 &#39;/ExternalResource&#39;: a=
uth_users_config,<br><br>.....<br><br>https_cp_app =3D cherrypy.tree.mount(=
<a href=3D"http://api_sub_domain_container.dev" target=3D"_blank">api_sub_d=
omain_container.dev</a>,<br>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0 &#39;/a_mount&#39;,<br>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0 sslConfig)<br><br></div>

<p></p>

-- <br>
You received this message because you are subscribed to the Google Groups &=
quot;cherrypy-users&quot; group.<br>
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to <a href=3D"mailto:cherrypy-users+unsubscribe-/[email protected]" targ=
et=3D"_blank">cherrypy-users+unsubscribe-/[email protected]</a>.<br>
To view this discussion on the web visit <a href=3D"https://groups.google.c=
om/d/msgid/cherrypy-users/1acd7645-3603-4179-9d9f-4a882d9efee2%40googlegrou=
ps.com?utm_medium=3Demail&amp;utm_source=3Dfooter" target=3D"_blank">https:=
//groups.google.com/d/msgid/cherrypy-users/1acd7645-3603-4179-9d9f-4a882d9e=
fee2%40googlegroups.com</a>.<br>
</blockquote></div><br clear=3D"all"><div><br></div>-- <br><div dir=3D"ltr"=
 class=3D"gmail_signature"><div dir=3D"ltr">Cheers,<div>Sviatoslav.</div></=
div></div>

<p></p>

-- <br />
You received this message because you are subscribed to the Google Groups &=
quot;cherrypy-users&quot; group.<br />
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to <a href=3D"mailto:cherrypy-users+unsubscribe-/[email protected]">cher=
rypy-users+unsubscribe-/[email protected]</a>.<br />
To view this discussion on the web visit <a href=3D"https://groups.google.c=
om/d/msgid/cherrypy-users/CAFYONRCBkuGXcka34jWwAe4WPuKE0oWoj6v_GGS_m0US4z%3=
DJoA%40mail.gmail.com?utm_medium=3Demail&utm_source=3Dfooter">https://group=
s.google.com/d/msgid/cherrypy-users/CAFYONRCBkuGXcka34jWwAe4WPuKE0oWoj6v_GG=
S_m0US4z%3DJoA%40mail.gmail.com</a>.<br />

--000000000000971b0305935f390c--