Re: ZEO server-side authentication protocol?

On Tue, Jan 17, 2017 at 1:47 PM, Bill Janssen <[email protected]>
wrote:

> So I basically need to identify and authenticate each client connection,
> then use that authenticated identity to authorize access for the particular
> database.
>

Well, this isn't really a public API.  I'm not saying that that's a good
thing. Historically, people haven't created server directly, but rather
through runzeo.  You'll need to do something different of course.  I
suggest for now doing whatever you need to implement what you want. After
you're sure it has value, we can discuss how to make the integration
cleaner.


>
> It would be nice if the additional arguments to things like
> StorageServer.__init__ were documented in the docstring.  What is the "ssl"
> parameter, for instance?
>

It's an SSLContext object.

Jim


>
>
> Bill
>
> On Mon, Jan 16, 2017 at 6:06 PM, Bill Janssen <[email protected]>
> wrote:
>
>> Actually, that was my original plan.  Issue a unique cert to each client,
>> and use that to both authenticate to the server, and select that user's
>> database (or databases; ideally I'd like to be able to share some databases
>> between multiple users).
>>
>> Bill
>>
>> On Monday, January 16, 2017 at 5:16:24 PM UTC-8, Jim Fulton wrote:
>>>
>>> Well, this is a bit off the beaten path, but it's doable with a bit of
>>> extra coding.
>>>
>>> Look at:
>>>
>>>   https://github.com/zerodb/zerodb/blob/master/zerodb/permissi
>>> ons/subdb.py#L46
>>>
>>> In that experiment, we were authenticating users by client cert, which
>>> was a lot more complicated than what you're trying to do I think.
>>>
>>> If this isn't straightforward to work out, let me know and I'll try to
>>> explain further. (But I'd be happy not to have to reload this stuff into my
>>> brain. :) )
>>>
>>> Jim
>>>
>>> On Mon, Jan 16, 2017 at 7:59 PM, Bill Janssen <[email protected]>
>>> wrote:
>>>
>>>> I think what I'd really like is for there to be multiple "filestorage"
>>>> sections, which are selected by which identity connects to the server.
>>>>
>>>> Bill
>>>>
>>>> On Monday, January 16, 2017 at 3:14:09 PM UTC-8, Jim Fulton wrote:
>>>>>
>>>>>
>>>>>
>>>>> On Mon, Jan 16, 2017 at 6:05 PM, Bill Janssen <[email protected]>
>>>>> wrote:
>>>>>
>>>>>> I've been looking through the ZEO 5.1.1 sources, trying to see where
>>>>>> client-certificates would appear, and where the authentication API is.
>>>>>> Unfortunately, I'm not finding documentation on this.
>>>>>>
>>>>>
>>>>> https://github.com/zopefoundation/ZEO#server-ssl-configuration
>>>>>
>>>>> Jim
>>>>>
>>>>> --
>>>>> Jim Fulton
>>>>> http://jimfulton.info
>>>>>
>>>> --
>>>> You received this message because you are subscribed to the Google
>>>> Groups "zodb" group.
>>>> To unsubscribe from this group and stop receiving emails from it, send
>>>> an email to [email protected].
>>>> For more options, visit https://groups.google.com/d/optout.
>>>>
>>>
>>>
>>>
>>> --
>>> Jim Fulton
>>> http://jimfulton.info
>>>
>> --
>> You received this message because you are subscribed to the Google Groups
>> "zodb" group.
>> To unsubscribe from this group and stop receiving emails from it, send an
>> email to [email protected].
>> For more options, visit https://groups.google.com/d/optout.
>>
>
> --
> You received this message because you are subscribed to the Google Groups
> "zodb" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to [email protected].
> For more options, visit https://groups.google.com/d/optout.
>



-- 
Jim Fulton
http://jimfulton.info

-- 
You received this message because you are subscribed to the Google Groups "zodb" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
For more options, visit https://groups.google.com/d/optout.