Im trying to implement simple authentication in Pyramid by using AuthTktAuthenticationPolicy. I follow this - authentication and this - authorization.
init.py
from pyramid.config import Configurator
from pyramid.authentication import AuthTktAuthenticationPolicy
from pyramid.authorization import ACLAuthorizationPolicy
from .security import groupfinder, Root
def main(global_config, **settings):
""" This function returns a Pyramid WSGI application.
"""
#config = Configurator(settings=settings)
# ACL
config = Configurator(settings=settings, root_factory=Root)
authn_policy = AuthTktAuthenticationPolicy('sosecret', callback=groupfinder, hashalg='sha512')
authz_policy = ACLAuthorizationPolicy()
config.set_authentication_policy(authn_policy)
config.set_authorization_policy(authz_policy)
config.include('pyramid_jinja2')
config.include('.models')
config.include('.routes')
config.scan()
return config.make_wsgi_app()
security.py
GROUPS = {'admin': ['group:admin']}
USERS = {'receptionist' : 'receptionist'}
def groupfinder(userid, request):
print("It's here")
return ['group:admin']
from pyramid.security import Allow, Everyone
class Root(object):
def __acl__(self):
return [(Allow, Everyone, 'view'), (Allow, 'group:admin', 'edit')]
def __init__(self, request):
pass
my view default.py
...
@view_config(route_name='login', renderer='../templates/login.jinja2')
def login(request):
try:
if not ('user_name' in request.params and 'password' in request.params):
return {}
if request.params['user_name'] == '' or request.params['password'] == '':
raise Exception('Ada inputan yang kosong dari form')
match_ = request.dbsession.query(TblUser).filter_by(user_name=request.params['user_name'], user_password=request.params['password']).one()
username = request.params['user_name']
if match_ is not None:
headers = remember(request, username)
request.response.headerlist.extend(headers)
next_url = request.route_url('search-room')
return HTTPFound(location=next_url)
except Exception as e:
log.exception(str(e))
return {'code' : 'error', 'message' : str(e) }
...
@view_config(route_name='search-room', renderer='../templates/search-room.jinja2', permission='edit')
def search_room(request):
try:
if not ('floor' in request.params):
return {}
if request.params['floor'] == '':
raise Exception('Ada inputan yang kosong dari form')
query = request.dbsession.query(TblReservation)
result = query.join(TblRoom, aliased=True).filter_by(room_floor=request.params['floor']).all()
if result is None or len(result) < 1:
raise Exception("No row found")
return {'code' : 'ok', 'message' : '', 'content' : result }
except Exception as e:
log.exception(str(e))
return {'code' : 'error', 'message' : str(e), 'content' : ''}
Full code in repo https://github.com/muhakbaryasin/pyramid-simple-acl
I set at least the user need to be authenticated and authorized as 'admin' so it can get 'edit' role and access 'search-room' page.
What I got right now is the login process is done but it wont give the authorization to access 'search-room' and the groupfinder is never invoked.
What do I miss? :(
Run a diff against the source in the Pyramid Quick Tutorial to find what you missed.