mozilla-services / repoze.who.plugins.memcached

INACTIVE - http://mzl.la/ghe-archive - repoze.who plugin for caching auth/metadata results

repoze.who.plugins.memcached

This is a repoze.who IAuthenticator/IMetadataProvider plugin that can cache the results of other plugins using memcached. It's useful for reducing load on e.g. a backend LDAP auth system.

To use it, give it the name of an authenticator and/or metadata provider whose results it should wrap:

[plugin:ldap]
use = my.ldap.authenticator

[plugin:cached_ldap]
use = repoze.who.plugins.memcached
authenticator_name = ldap

[authenticators]
plugins = cached_ldap ldap;unused

(The "ldap;unused" bit ensures that the wrapped ldap plugin still gets loaded, but is not used for matching any requests. Yeah, it's yuck.)

To prevent a compromise of the cache from revealing auth credentials, this plugin calculates a HMAC hash of the items in the incoming identity and uses that as the cache key. This makes it possible to check the cache for a match to an incoming identity, while preventing the cache keys from being reversed back into a valid identity.

Items added to the identity by the wrapped plugin will be stored in the cached value and will not be encryped or obfuscated in any way.

The following configuration options are available:

• memcached_urls: A list of URLs for the underlying memcached store.
• authenticator_name: The name of an IAuthenticator plugin to wrap.
• mdprovider_name: The name of an IMetadataProvider plugin to wrap.

• key_items: A list of names from the identity dict that should be

  hashed to produce the cache key. These items should uniquely and validly identity a user. By default it will use all keys in the identity in sorted order.

• value_items: A list of names from the identity dict that should be

  stored in the cache. These would typically be items of metadata such as the user's email address. By default this will include all items that the wrapped plugin adds to the identity.

• secret: A string used when calculating the HMAC the cache keys.

  All servers accessing a shared cache should use the same secret so they produce the same set of cache keys.

• ttl: The time for which cache entries should persist, in seconds.

repoze.who.plugins.memcached's Issues

CODE_OF_CONDUCT.md file missing

As of January 1 2019, Mozilla requires that all GitHub projects include this CODE_OF_CONDUCT.md file in the project root. The file has two parts:

1. Required Text - All text under the headings Community Participation Guidelines and How to Report, are required, and should not be altered.
2. Optional Text - The Project Specific Etiquette heading provides a space to speak more specifically about ways people can work effectively and inclusively together. Some examples of those can be found on the Firefox Debugger project, and Common Voice. (The optional part is commented out in the raw template file, and will not be visible until you modify and uncomment that part.)

If you have any questions about this file, or Code of Conduct policies and procedures, please reach out to [email protected].

(Message COC001)