[dev] User authentication via certs Re: ZEO server-side authentication protocol?

On Mon, Jan 16, 2017 at 9:06 PM, Bill Janssen <[email protected]
<https://mail.google.com/mail/?view=cm&fs=1&tf=1&[email protected]>>
wrote:

> Actually, that was my original plan.  Issue a unique cert to each client,
> and use that to both authenticate to the server, and select that user's
> database (or databases; ideally I'd like to be able to share some databases
> between multiple users).
>

Well, then I'd like at more of that project, and especially that package.

One issue that complicated things is that if you're using this for users,
it's likely you're going to want to be able to update user credentials
without having to restart the database server. If a user changes their
cert, you'll want to stop honoring the old one. SSLContext objects don't
provide a way to remove certs, and asyncio event loops don't let you change
their SSL contexts.  This is potentially fixable with changes to the SSL
module or to asyncio, but this isn't easy because the SSL module is a
wrapper a C API and asyncio has multiple implementations.

What I ended up doing is creating a separate main loop per client so I
could create a new SSLContext per client. (This too ultimately required
some ayncio changes.)  ZEO4 created a separate thread/loop per client.
ZEO5 allows either a thread per client, or a single shared thread.

Using a single shared thread seems to be much faster, although years ago, I
changed ZEO4 to use a thread per client as an optimization that was
supported by measurement. <shrug>.

IDK all of your requirements, but for ZeroDB, we decided it was simpler to
just use user names and passwords protected by SSL.

Of course, controlling which database is used for a user is an area for
experimentation in ZEO.

Jim

-- 
You received this message because you are subscribed to the Google Groups "zodb" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
For more options, visit https://groups.google.com/d/optout.