16. Authentication
16.1 Basic HTTP authentication
Karrigell supports basic HTTP authentication, a way to protect access to some files by requesting
a user identifier and a password. The server receives user input and stores it in the global
variables AUTH_USER and AUTH_PASSWORD . If the user enters a couple which
is allowed by the server then the page is sent back ; if the couple is not allowed then the user is
requested a new couple ; if the user cancels his request an error message is sent to him
In Karrigell, authentication is handled through the Authentication function ; call
Authentication(testFunction[,realm,
errorMessage]) where testFunction is a user-defined function
taking no argument, which returns true if the authentication test succeeds (depending on the values
of AUTH_USER and AUTH_PASSWORD ) and false otherwise, realm is a
string with the name of the authentication domain (the one that will appear on the popup window) and
errorMessage is a string displayed on the browser if the user cancels his authentication
request. Both realm and errorMessage have default values
Here is an example with a very simple test function :
<%
def authTest():
return (AUTH_USER=="proust" and AUTH_PASSWORD=="marcel")
Authentication(authTest,"Authentication test",\
"Sorry, you are not allowed to access this page")
%>
Welcome, authenticated user !
With this test function, if a visitor finds a way to read the source code, he will easily
discover a valid login/password couple. A better solution is to use md5 : it is a function which
takes a string as argument, and returns a 16-bytes "digest". The digest is guaranteed to be
different for two different strings, and it is impossible to find the string if you only know the
digest
A good method is to compute the md5 digests of user and password and store them in a file. The
authentication test will read this file, compute the digests of AUTH_USER and AUTH_PASSWORD, and
return true if the digests match
<%
import md5
digests=open("digest.ini","rb").read()
userDigest=digests[:16]
passwordDigest=digests[16:]
def authTest():
return (md5.new(AUTH_USER).digest()==userDigest and \
md5.new(AUTH_PASSWORD).digest()==passwordDigest)
Authentication(authTest,"Authentication test",\
"Sorry, you are not allowed to access this page")
%>
Welcome, authenticated user !
See the k_password.py script, in the admin directory, which
generates a file with the md5 digests of administrator's login and password
16.2 The RestrictToAdmin() function
A shortcut is provided to restrict access to a page to the administrator whose login and password
have been defined by the k_password.py script : a function called RestrictToAdmin()
Put it at the beginning of your script, like this :
RestrictTo Admin()
print "Hello !"
The browser will ask for the admin's information before showing the page
By default, this information is searched in the file admin.ini in the folder admin. If you
want to use another file you can specify it as argument to the function RestrictToAdmin() :
RestrictTo Admin(admin_file_name)
print "Hello !"
The format of this file must be the same as the one generated by k_password.py
|