On Thu, 2009-05-07 at 12:13 -0400, Bill Peck wrote:
James Laska wrote:
> Great summary!
> On Tue, 2009-05-05 at 14:51 -0400, Bill Peck wrote:
>> Plans for May
>> - Get proper kerberos working in xmlrpc interface
> This is probably a long ways off, but do you have any thoughts on how
> the authentication in beaker can be modular? Meaning, is this something
> we could plug into FAS or openid when the time comes for a hosted
> instance in Fedora?
It should be able to be modular.
I'm developing the app with two entry points for authentication:
1) coming in via the web browser
2) coming in via xmlrpc
Both entry points then use the identity module in turbogears to
authenticate the user with a slight modification if you do kerberos auth.
Kerberos auth for the web interface relies on apache doing the negotiate
with the browser, When it gets to Turbogears identity module we are
already authenticated and I ask cherrypy for remote_user and if that
user exists in the User model then I log them in.
Without Kerberos the identity module authenticates the username/password
against either the local DB or an ldap Server. If configured for LDAP
we also check for DB accounts, this allows for local accounts that are
not in LDAP.
The XMLRPC login does basically the same thing except that kerberos is
handled in the Turbogears app since python and perl clients don't seem
to support negotiate.
To support FAS or OpenID we just need to extend identity.py to
understand those services.
For the XMLRPC client side I'm currently testing Daniel Mach's kobo
project. This infrastructure takes care of logging into the service
(supports kerberos or password based) and gives a nice plugin framework
for commands you want to add. Its not open sourced yet but he's working
on it, Hopefully in a month or so.
Hope that answers your questions.
Sure does, thanks!