Karrigell Documentation

Version 2.2.1 13 12 05

Français

14. Authentication

Karrigell supports basic HTTP authentication, a way to protect access to some files by requesting a user identifier and a password. The server receives user input and stores it in the global variables AUTH_USER and AUTH_PASSWORD. If the user enters a couple which is allowed by the server then the page is sent back ; if the couple is not allowed then the user is requested a new couple ; if the user cancels his request an error message is sent to him

In Karrigell, authentication is handled through the Authentication function ; call Authentication(testFunction[,realm, errorMessage]) where testFunction is a user-defined function taking no argument, which returns true if the authentication test succeeds (depending on the values of AUTH_USER and AUTH_PASSWORD) and false otherwise, realm is a string with the name of the authentication domain (the one that will appear on the popup window) and errorMessage is a string displayed on the browser if the user cancels his authentication request. Both realm and errorMessage have default values

Here is an example with a very simple test function :

<%
def authTest():
    return (AUTH_USER=="proust" and AUTH_PASSWORD=="marcel")
Authentication(authTest,"Authentication test",\
    "Sorry, you are not allowed to access this page")
%>
Welcome, authenticated user !

With this test function, if a visitor finds a way to read the source code, he will easily discover a valid login/password couple. A better solution is to use md5 : it is a function which takes a string as argument, and returns a 16-bytes "digest". The digest is guaranteed to be different for two different strings, and it is impossible to find the string if you only know the digest
A good method is to compute the md5 digests of user and password and store them in a file. The authentication test will read this file, compute the digests of AUTH_USER and AUTH_PASSWORD, and return true if the digests match

<%
import md5
digests=open("digest.ini","rb").read()
userDigest=digests[:16]
passwordDigest=digests[16:]
def authTest():
    return (md5.new(AUTH_USER).digest()==userDigest and \
        md5.new(AUTH_PASSWORD).digest()==passwordDigest)
Authentication(authTest,"Authentication test",\
    "Sorry, you are not allowed to access this page")
%>
Welcome, authenticated user !

See the k_password.py script, in the admin directory, which generates a file with the md5 digests of administrator's login and password