AuthKit

The patch for Map Fish?

The patch for Routes v1.9.2

The patch for AuthKit

I forgot to add a few stuff...

You have to change your middleware like that:

if asbool(full_stack):
        # Handle Python exceptions
        app = ErrorHandler(app, global_conf, error_template=error_template,
                           **config['pylons.errorware'])

        # AuthKit authentication
        import authkit.authenticate
        app = authkit.authenticate.middleware(app, app_conf)
        from beaker.middleware import SessionMiddleware
        app = SessionMiddleware(app, {})

        # Display error documents for 401, 403, 404 status codes (and
        # 500 when debug is disabled)
        app = ErrorDocuments(app, global_conf, mapper=error_mapper, **app_conf)

You have to add that at the end of your myproject.model.__init__.py:

meta = MetaData(config['pylons.g'].sa_unhcr_webgis_engine)
meta.Session = Session

Small change to do in the Map Fish Authentication?.patch: s/auth_proxy.addRoutes/auth_proxy.add_routes/ in the documentation

version 2

This new version adds support for exporting the permissions as JSON (to be used by the client to modify the UI according to the permissions).

For the AuthProxyController controller, it is possible to use multiple WMS servers. Here's an example controller with configuration:

class WmsAuthProxyController(AuthProxyController):
    def __init__(self):
        layers = []
        layers.append(WMSLayer(alias="c2corg",
                               url="http://demo.mapfish.org/mapfishsample/trunk/wms",
                               layers={
                                       "summits": HasAuthKitRole('view'),
                                       "DEFAULT": Deny()
                               }))
        layers.append(TileCacheLayer(alias="tilecache",
                                     url="http://example.com/tilecache/",
                                     layers={
                                             "background": HasAuthKitRole('view'),
                                             "camp_mapserver": HasAuthKitRole('view')
                                     }))
        self.set_layers(layers)
 

A new controller, SecurityController is used to publish permissions to the client. It will read the permission options from a <packagename>/config/permissions.py python file, here's an example:

from authkit.permissions import HasAuthKitRole, ValidAuthKitUser
from mapfish.controllers.security import Deny

permissions = {
    "application": ValidAuthKitUser(),
    "application.widgets.edit": HasAuthKitRole("editor"),
    "widgets.print.dpi.100": Deny()
}

It will also call the get_permissions method on each of the controllers so that they can provide module specific permissions. The controller then computes permissions according to the user's roles and then return them as JSON.

The client part is not implemented yet. Some things need to be completed and tests added.

for review

Last patch content: New auth_proxy (based on Patrick's version) and security controllers. user_auth AuthKit module (by Patrick). new Pylons testapp application for unit testing the MapFish Pylons controllers (with tests for auth_proxy and security controllers).

Please review.

Just to note that if you are using the user name/password/roles declared inside the project .ini file, you can use Auht Kit? 0.4 and don't need to patch Routes or Auth Kit?.

I had some issues with empty files. Do this for creating them:

mkdir -p ./server/python/testapp/testapp/model/
touch ./server/python/testapp/testapp/model/__init__.py \
      ./server/python/testapp/testapp/__init__.py \
      ./server/python/testapp/testapp/controllers/__init__.py \
      ./server/python/testapp/testapp/tests/functional/__init__.py \
      ./server/python/testapp/testapp/tests/test_models.py \
      ./server/python/testapp/testapp/config/__init__.py \
      ./server/python/testapp/testapp/lib/__init__.py

Let's not include the Cached Users From Database? class in the patch, as this one can be used only if Routes and AuthKit are patched (with Patrick's patches). The rest looks good, please commit.

(In [959]) New auth_proxy (based on Patrick's version) and security controllers. new Pylons testapp application for unit testing the Map Fish? Pylons controllers (with tests for auth_proxy and security controllers). r=elemoine (closes #210)