Question

我试图通过使用AuthTktAuthenticationPolicy在Pyramid中实现简单的身份验证。我关注this - authentication和this - authorization。

的初始化的.py

from pyramid.config import Configurator

from pyramid.authentication import AuthTktAuthenticationPolicy
from pyramid.authorization import ACLAuthorizationPolicy
from .security import groupfinder, Root


def main(global_config, **settings):
    """ This function returns a Pyramid WSGI application.
    """
    #config = Configurator(settings=settings)

    # ACL
    config = Configurator(settings=settings, root_factory=Root)
    authn_policy = AuthTktAuthenticationPolicy('sosecret', callback=groupfinder, hashalg='sha512')
    authz_policy = ACLAuthorizationPolicy()
    config.set_authentication_policy(authn_policy)
    config.set_authorization_policy(authz_policy)

    config.include('pyramid_jinja2')
    config.include('.models')
    config.include('.routes')
    config.scan()
    return config.make_wsgi_app()

security.py

GROUPS = {'admin': ['group:admin']}
USERS = {'receptionist' : 'receptionist'}

def groupfinder(userid, request):
    print("It's here")
    return ['group:admin']

from pyramid.security import Allow, Everyone

class Root(object):
    def __acl__(self):
        return [(Allow, Everyone, 'view'), (Allow, 'group:admin', 'edit')]

def __init__(self, request):
    pass

我的观点default.py

...

@view_config(route_name='login', renderer='../templates/login.jinja2')
def login(request):
    try:
        if not ('user_name' in request.params and 'password' in request.params):
            return {}

        if request.params['user_name'] == '' or request.params['password'] == '':
            raise Exception('Ada inputan yang kosong dari form')

        match_ = request.dbsession.query(TblUser).filter_by(user_name=request.params['user_name'], user_password=request.params['password']).one()
        username = request.params['user_name']

        if match_ is not None:
            headers = remember(request, username)
            request.response.headerlist.extend(headers)
            next_url = request.route_url('search-room')

            return HTTPFound(location=next_url)

    except Exception as e:
        log.exception(str(e))
        return {'code' : 'error', 'message' : str(e) }

...

@view_config(route_name='search-room', renderer='../templates/search-room.jinja2', permission='edit')
def search_room(request):
    try:
        if not ('floor' in request.params):
            return {}

        if request.params['floor'] == '':
            raise Exception('Ada inputan yang kosong dari form')

        query = request.dbsession.query(TblReservation)
        result = query.join(TblRoom, aliased=True).filter_by(room_floor=request.params['floor']).all()

        if result is None or len(result) < 1:
            raise Exception("No row found")

        return {'code' : 'ok', 'message' : '', 'content' : result }

    except Exception as e:
        log.exception(str(e))
        return {'code' : 'error', 'message' : str(e), 'content' : ''}

回购https://github.com/muhakbaryasin/pyramid-simple-acl

中的完整代码

我至少设置了用户需要进行身份验证和授权的“管理员”＃39;所以它可以编辑＆＃39;角色和访问＆＃39;搜索室＆＃39;页。

我现在得到的是登录过程已完成，但它不会授权访问搜索室＆＃39;并且永远不会调用 groupfinder 。

我想念什么？：（

Answer 1

对source in the Pyramid Quick Tutorial运行差异以查找错过的内容。

从未调用Pyramid AuthTktAuthenticationPolicy回调

1 个答案: