Package cherrypy :: Package lib :: Module auth_digest
[hide private]
[frames] | no frames]

Module auth_digest

source code

An implementation of the server-side of HTTP Digest Access Authentication, which is described in :rfc:`2617`.

Example usage, using the built-in get_ha1_dict_plain function which uses a dict of plaintext passwords as the credentials store:

   userpassdict = {'alice' : '4x5istwelve'}
   get_ha1 = cherrypy.lib.auth_digest.get_ha1_dict_plain(userpassdict)
   digest_auth = {'tools.auth_digest.on': True,
                  'tools.auth_digest.realm': 'wonderland',
                  'tools.auth_digest.get_ha1': get_ha1,
                  'tools.auth_digest.key': 'a565c27146791cfb',
   }
   app_config = { '/' : digest_auth }

Date: April 2009

Author: visteya

Classes [hide private]
  HttpDigestAuthorization
Class to parse a Digest Authorization header and perform re-calculation of the digest.
Functions [hide private]
 
md5_hex(s) source code
 
TRACE(msg) source code
 
get_ha1_dict_plain(user_password_dict)
Returns a get_ha1 function which obtains a plaintext password from a dictionary of the form: {username : password}.
source code
 
get_ha1_dict(user_ha1_dict)
Returns a get_ha1 function which obtains a HA1 password hash from a dictionary of the form: {username : HA1}.
source code
 
get_ha1_file_htdigest(filename)
Returns a get_ha1 function which obtains a HA1 password hash from a flat file with lines of the same format as that produced by the Apache htdigest utility.
source code
 
synthesize_nonce(s, key, timestamp=None)
Synthesize a nonce value which resists spoofing and can be checked for staleness.
source code
 
H(s)
The hash function H
source code
 
www_authenticate(realm, key, algorithm='MD5', nonce=None, qop='auth', stale=False)
Constructs a WWW-Authenticate header for Digest authentication.
source code
 
digest_auth(realm, get_ha1, key, debug=False)
A CherryPy tool which hooks at before_handler to perform HTTP Digest Access Authentication, as specified in :rfc:`2617`.
source code
Variables [hide private]
  __doc__ = """An implementation of the server-side of HTTP Dige...
  qop_auth = 'auth'
  qop_auth_int = 'auth-int'
  valid_qops = ('auth', 'auth-int')
  valid_algorithms = ('MD5', 'MD5-sess')
  __package__ = 'cherrypy.lib'
Function Details [hide private]

get_ha1_dict_plain(user_password_dict)

source code 

Returns a get_ha1 function which obtains a plaintext password from a dictionary of the form: {username : password}.

If you want a simple dictionary-based authentication scheme, with plaintext passwords, use get_ha1_dict_plain(my_userpass_dict) as the value for the get_ha1 argument to digest_auth().

get_ha1_dict(user_ha1_dict)

source code 

Returns a get_ha1 function which obtains a HA1 password hash from a dictionary of the form: {username : HA1}.

If you want a dictionary-based authentication scheme, but with pre-computed HA1 hashes instead of plain-text passwords, use get_ha1_dict(my_userha1_dict) as the value for the get_ha1 argument to digest_auth().

get_ha1_file_htdigest(filename)

source code 

Returns a get_ha1 function which obtains a HA1 password hash from a flat file with lines of the same format as that produced by the Apache htdigest utility. For example, for realm 'wonderland', username 'alice', and password '4x5istwelve', the htdigest line would be:

   alice:wonderland:3238cdfe91a8b2ed8e39646921a02d4c

If you want to use an Apache htdigest file as the credentials store, then use get_ha1_file_htdigest(my_htdigest_file) as the value for the get_ha1 argument to digest_auth(). It is recommended that the filename argument be an absolute path, to avoid problems.

synthesize_nonce(s, key, timestamp=None)

source code 
Synthesize a nonce value which resists spoofing and can be checked for staleness.
Returns a string suitable as the value for 'nonce' in the www-authenticate header.

s
    A string related to the resource, such as the hostname of the server.

key
    A secret string known only to the server.

timestamp
    An integer seconds-since-the-epoch timestamp

digest_auth(realm, get_ha1, key, debug=False)

source code 
A CherryPy tool which hooks at before_handler to perform
HTTP Digest Access Authentication, as specified in :rfc:`2617`.

If the request has an 'authorization' header with a 'Digest' scheme, this
tool authenticates the credentials supplied in that header.  If
the request has no 'authorization' header, or if it does but the scheme is
not "Digest", or if authentication fails, the tool sends a 401 response with
a 'WWW-Authenticate' Digest header.

realm
    A string containing the authentication realm.

get_ha1
    A callable which looks up a username in a credentials store
    and returns the HA1 string, which is defined in the RFC to be
    MD5(username : realm : password).  The function's signature is:
    ``get_ha1(realm, username)``
    where username is obtained from the request's 'authorization' header.
    If username is not found in the credentials store, get_ha1() returns
    None.

key
    A secret string known only to the server, used in the synthesis of nonces.


Variables Details [hide private]

__doc__

Value:
"""An implementation of the server-side of HTTP Digest Access
Authentication, which is described in :rfc:`2617`.

Example usage, using the built-in get_ha1_dict_plain function which us\
es a dict
of plaintext passwords as the credentials store::

    userpassdict = {'alice' : '4x5istwelve'}
...