Re: ZEO server-side authentication protocol?

On Tue, Jan 17, 2017 at 10:56 AM, Jim Fulton <[email protected]> wrote:

>
>
> On Tue, Jan 17, 2017 at 1:47 PM, Bill Janssen <[email protected]>
> wrote:
>
>> So I basically need to identify and authenticate each client connection,
>> then use that authenticated identity to authorize access for the particular
>> database.
>>
>
> Well, this isn't really a public API.  I'm not saying that that's a good
> thing. Historically, people haven't created server directly, but rather
> through runzeo.  You'll need to do something different of course.  I
> suggest for now doing whatever you need to implement what you want. After
> you're sure it has value, we can discuss how to make the integration
> cleaner.
>

I can only "implement what I want" if I can understand how to do that.
Right now, I'm trying to figure out how the storage ID is passed to the
server from the acceptor, so that I can mimic this for the user ID.  Maze
of callbacks and private undocumented APIs is making it tough.


>> It would be nice if the additional arguments to things like
>> StorageServer.__init__ were documented in the docstring.  What is the "ssl"
>> parameter, for instance?
>>
>
> It's an SSLContext object.
>

You might consider naming that parameter, "ssl_context", instead of "ssl".
And add that to the docstring.

Bill


> Jim
>
>
>>
>>
>> Bill
>>
>> On Mon, Jan 16, 2017 at 6:06 PM, Bill Janssen <[email protected]>
>> wrote:
>>
>>> Actually, that was my original plan.  Issue a unique cert to each
>>> client, and use that to both authenticate to the server, and select that
>>> user's database (or databases; ideally I'd like to be able to share some
>>> databases between multiple users).
>>>
>>> Bill
>>>
>>> On Monday, January 16, 2017 at 5:16:24 PM UTC-8, Jim Fulton wrote:
>>>>
>>>> Well, this is a bit off the beaten path, but it's doable with a bit of
>>>> extra coding.
>>>>
>>>> Look at:
>>>>
>>>>   https://github.com/zerodb/zerodb/blob/master/zerodb/permissi
>>>> ons/subdb.py#L46
>>>>
>>>> In that experiment, we were authenticating users by client cert, which
>>>> was a lot more complicated than what you're trying to do I think.
>>>>
>>>> If this isn't straightforward to work out, let me know and I'll try to
>>>> explain further. (But I'd be happy not to have to reload this stuff into my
>>>> brain. :) )
>>>>
>>>> Jim
>>>>
>>>> On Mon, Jan 16, 2017 at 7:59 PM, Bill Janssen <[email protected]>
>>>> wrote:
>>>>
>>>>> I think what I'd really like is for there to be multiple "filestorage"
>>>>> sections, which are selected by which identity connects to the server.
>>>>>
>>>>> Bill
>>>>>
>>>>> On Monday, January 16, 2017 at 3:14:09 PM UTC-8, Jim Fulton wrote:
>>>>>>
>>>>>>
>>>>>>
>>>>>> On Mon, Jan 16, 2017 at 6:05 PM, Bill Janssen <[email protected]>
>>>>>> wrote:
>>>>>>
>>>>>>> I've been looking through the ZEO 5.1.1 sources, trying to see where
>>>>>>> client-certificates would appear, and where the authentication API is.
>>>>>>> Unfortunately, I'm not finding documentation on this.
>>>>>>>
>>>>>>
>>>>>> https://github.com/zopefoundation/ZEO#server-ssl-configuration
>>>>>>
>>>>>> Jim
>>>>>>
>>>>>> --
>>>>>> Jim Fulton
>>>>>> http://jimfulton.info
>>>>>>
>>>>> --
>>>>> You received this message because you are subscribed to the Google
>>>>> Groups "zodb" group.
>>>>> To unsubscribe from this group and stop receiving emails from it, send
>>>>> an email to [email protected].
>>>>> For more options, visit https://groups.google.com/d/optout.
>>>>>
>>>>
>>>>
>>>>
>>>> --
>>>> Jim Fulton
>>>> http://jimfulton.info
>>>>
>>> --
>>> You received this message because you are subscribed to the Google
>>> Groups "zodb" group.
>>> To unsubscribe from this group and stop receiving emails from it, send
>>> an email to [email protected].
>>> For more options, visit https://groups.google.com/d/optout.
>>>
>>
>> --
>> You received this message because you are subscribed to the Google Groups
>> "zodb" group.
>> To unsubscribe from this group and stop receiving emails from it, send an
>> email to [email protected].
>> For more options, visit https://groups.google.com/d/optout.
>>
>
>
>
> --
> Jim Fulton
> http://jimfulton.info
>

-- 
You received this message because you are subscribed to the Google Groups "zodb" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
For more options, visit https://groups.google.com/d/optout.