Karrigell Documentation

Version 2.3.3 15 01 07

Français

16. Authentication

16.1 Basic HTTP authentication

Karrigell supports basic HTTP authentication, a way to protect access to some files by requesting a user identifier and a password. The server receives user input and stores it in the global variables AUTH_USER and AUTH_PASSWORD. If the user enters a couple which is allowed by the server then the page is sent back ; if the couple is not allowed then the user is requested a new couple ; if the user cancels his request an error message is sent to him

In Karrigell, authentication is handled through the Authentication function ; call Authentication(testFunction[,realm, errorMessage]) where testFunction is a user-defined function taking no argument, which returns true if the authentication test succeeds (depending on the values of AUTH_USER and AUTH_PASSWORD) and false otherwise, realm is a string with the name of the authentication domain (the one that will appear on the popup window) and errorMessage is a string displayed on the browser if the user cancels his authentication request. Both realm and errorMessage have default values

Here is an example with a very simple test function :

<%
def authTest():
    return (AUTH_USER=="proust" and AUTH_PASSWORD=="marcel")
Authentication(authTest,"Authentication test",\
    "Sorry, you are not allowed to access this page")
%>
Welcome, authenticated user !

With this test function, if a visitor finds a way to read the source code, he will easily discover a valid login/password couple. A better solution is to use md5 : it is a function which takes a string as argument, and returns a 16-bytes "digest". The digest is guaranteed to be different for two different strings, and it is impossible to find the string if you only know the digest
A good method is to compute the md5 digests of user and password and store them in a file. The authentication test will read this file, compute the digests of AUTH_USER and AUTH_PASSWORD, and return true if the digests match

<%
import md5
digests=open("digest.ini","rb").read()
userDigest=digests[:16]
passwordDigest=digests[16:]
def authTest():
    return (md5.new(AUTH_USER).digest()==userDigest and \
        md5.new(AUTH_PASSWORD).digest()==passwordDigest)
Authentication(authTest,"Authentication test",\
    "Sorry, you are not allowed to access this page")
%>
Welcome, authenticated user !

See the k_password.py script, in the admin directory, which generates a file with the md5 digests of administrator's login and password

16.2 The RestrictToAdmin() function

A shortcut is provided to restrict access to a page to the administrator whose login and password have been defined by the k_password.py script : a function called RestrictToAdmin() Put it at the beginning of your script, like this :

RestrictTo Admin()
print "Hello !"
The browser will ask for the admin's information before showing the page By default, this information is searched in the file admin.ini in the folder admin. If you want to use another file you can specify it as argument to the function RestrictToAdmin() :

RestrictTo Admin(admin_file_name)
print "Hello !"
The format of this file must be the same as the one generated by k_password.py