Question

我正在使用金字塔，我已经设置了非常基本的安全性/ ACL。我有一些页面，我想拒绝为经过身份验证的用户（注册，登录等）访问，这很容易通过在我的acl中使用它：

(Deny, Authenticated, 'guest'),

问题在于，如果我也有这个，它会忽略后来的'拒绝'：

(Allow, Everyone, 'guest'),

所以我的想法是在未经身份验证的用户上添加一个我可以挂钩的主体（看到有Authenticated，但没有Unauthenticated。

def authenticated(userid, request):
    if userid == unauthenticated_userid(request):
        return ['auth:guest']

    user = User.get_by_username(userid)

    if not user:
        None

    if user.admin:
        return ['group:admins', 'group:users']

    return ['group:users']

问题是，如果用户未经过身份验证，则AuthTktAuthenticationPolicy图层似乎不会调用回调函数（而是选择仅提供主体['system.Everyone']并将其称为一天）。

那么，如果有的话，我在这里失踪了吗？

以下完整的ACL，安全性和配置：

class Root(object):
    __name__ = None
    __parent__ = None
    __acl__ = [
        (Allow, Everyone, 'view'),
        (Allow, 'auth:guest', 'guest'),
        (Deny, Authenticated, 'guest'),
        (Allow, Authenticated, 'auth'),
        (Allow, 'group:admins', 'admin'),
    ]

    def __init__(self, request):
        self.request = request

def main(global_config, **settings):
    """ This function returns a Pyramid WSGI application.
    """
    engine = engine_from_config(settings, 'sqlalchemy.')
    DBSession.configure(bind=engine)

    authn_policy = AuthTktAuthenticationPolicy('devdbcookiesig',
                                               callback=authenticated,
                                               hashalg='sha512')
    authz_policy = ACLAuthorizationPolicy()

    Base.metadata.bind = engine
    config = Configurator(settings=settings,
                          root_factory=Root)

    config.set_authentication_policy(authn_policy)
    config.set_authorization_policy(authz_policy)

    config.include('pyramid_chameleon')

    config.add_static_view('static', 'static', cache_max_age=3600)

    config.set_request_property(get_user, 'user', reify=True)

    # ... the rest is standard routing

security.py：

from model.user import User
from pyramid.security import unauthenticated_userid

def get_user(request):
    # the below line is just an example, use your own method of
    # accessing a database connection here (this could even be another
    # request property such as request.db, implemented using this same
    # pattern).
    userid = unauthenticated_userid(request)
    if userid is not None:
        # this should return None if the user doesn't exist
        # in the database
        return User.get_by_username(userid)

def authenticated(userid, request):
    if userid == unauthenticated_userid(request):
        return ['auth:guest']

    user = User.get_by_username(userid)

    if not user:
        None

    if user.admin:
        return ['group:admins', 'group:users']

    return ['group:users']

最后是错误：

HTTPForbidden: debug_authorization of url http://localhost/signin (view name u'' against context <devdb.Root object at 0x3dd1f10>): ACLDenied permission 'guest' via ACE '<default deny>' in ACL [('Allow', 'system.Everyone', 'view'), ('Allow', 'auth:guest', 'guest'), ('Deny', 'system.Authenticated', 'guest'), ('Allow', 'system.Authenticated', 'auth'), ('Allow', 'group:admins', 'admin')] on context <devdb.Root object at 0x3dd1f10> for principals ['system.Everyone']

Answer 1

想出来（有点）。 ACL中的项目顺序很重要，因此如果我在为每个人设置允许之前将Deny用于对guest虚拟机进行身份验证，则可以正常运行。

__acl__ = [
    (Allow, Everyone, 'view'),
    (Deny, Authenticated, 'guest'),
    (Allow, Everyone, 'guest'),
    (Allow, Authenticated, 'auth'),
    (Allow, 'group:admins', 'admin'),
]

工作时

__acl__ = [
    (Allow, Everyone, 'view'),
    (Allow, Everyone, 'guest'),
    (Deny, Authenticated, 'guest'),
    (Allow, Authenticated, 'auth'),
    (Allow, 'group:admins', 'admin'),
]

没有（经过身份验证的用户在遇到“拒绝身份验证”之前选择“允许所有人”）

仍然没有解决“为什么我不能向未经身份验证的用户添加自定义主体”的问题，但它让我得到了我需要的东西。

金字塔安全性 - 为未经身份验证的用户添加主体

1 个答案: