gvalkov / tornado-http-auth

Digest and basic authentication for Tornado

tornado-http-auth

Digest and basic authentication for the Tornado web framework. Based on code and ideas from Twisted's cred.

Installation

The latest stable version of tornado-http-auth can be installed from pypi:

$ pip install tornado-http-auth

Usage

import tornado.ioloop
from tornado.web import RequestHandler, Application
from tornado_http_auth import DigestAuthMixin, BasicAuthMixin, auth_required

credentials = {'user1': 'pass1'}

# Example 1 (using decorator).
class MainHandler(DigestAuthMixin, RequestHandler):
    @auth_required(realm='Protected', auth_func=credentials.get)
    def get(self):
        self.write('Hello %s' % self._current_user)

# Example 2 (using prepare and get_authentciated_user).
class MainHandler(BasicAuthMixin, RequestHandler):
    def prepare(self):
        self.get_authenticated_user(check_credentials_func=credentials.get, realm='Protected')

    def get(self):
        self.write('Hello %s' % self._current_user)

app = Application([
    (r'/', MainHandler),
])

app.listen(8888)
tornado.ioloop.IOLoop.current().start()

# curl --user user1:pass1 -v http://localhost:8888  -> 200 OK
# curl --user user2:pass2 -v http://localhost:8888  -> 401 Unauthorized
# Remove or comment second class
# curl --digest --user user1:pass1 -v http://localhost:8888  -> 200 OK
# curl --digest --user user2:pass2 -v http://localhost:8888  -> 401 Unauthorized

License

This project is released under the terms of the Apache License, Version 2.0.

tornado-http-auth's Issues

Example on README has a problem

Running the example on README produces the following error:
File "test_http_auth.py", line 17, in prepare
self.get_authenticated_user(realm='Protected', auth_func=credentials.get)
TypeError: get_authenticated_user() got an unexpected keyword argument 'auth_func'

authenticate_user method raises binascii.Error when provided auth is not base64

authenticate_user method raises uncontrolled exception when the provided Authorization header is not base64. To reproduce the issue:

curl -i \
    -H 'Accept:application/json' \
    -H 'Authorization:Basic not_a_base64_string' \
    http://localhost:8000/protected

PAM-based authentication ?

I had a look at the code while attempting to setup a tornado server with http auth based on PAM and this :

challenge = check_credentials_func(username)
        if not challenge:
            raise self.SendChallenge()

        if challenge == password:

makes it somewhat incompatible with PAM authentication, as far as I can tell...

For reference : https://github.com/FirefighterBlu3/python-pam/blob/master/pam.py provides an authenticate(username, password) function where one passes the user and the password at once, and the return value (after some waiting time) determine if we are logged in or not.

Any hint/ideas on how to improve this ?

too many values to unpack (expected 2), line 210, in authenticate_user username, password = auth_data.split(':')

When a user put : (colon) on user name or password this packages produces this error.
too many values to unpack (expected 2), line 210, in authenticate_user username, password = auth_data.split(':')
It can be fixed simply by checking the number of colons if colon is prohibited in user name and password.