Ñò
Ä›ìIc @ s® d d k l Z d e f d „ ƒ YZ d e f d „ ƒ YZ d e f d „ ƒ YZ d e f d „ ƒ YZ d
e f d „ ƒ YZ d e f d
„ ƒ YZ d e f d „ ƒ YZ d S( iÿÿÿÿ( t Interfacet IPluginc B s e Z RS( ( t __name__t
__module__( ( ( s9 /usr/lib/python2.6/site-packages/repoze/who/interfaces.pyR s t IRequestClassifierc B s e Z d Z d „ Z RS( s% On ingress: classify a request.
c C s d S( sÏ environ -> request classifier string
This interface is responsible for returning a string
value representing a request classification.
o 'environ' is the WSGI environment.
N( ( t environ( ( s9 /usr/lib/python2.6/site-packages/repoze/who/interfaces.pyt __call__ s ( R R t __doc__R ( ( ( s9 /usr/lib/python2.6/site-packages/repoze/who/interfaces.pyR s t IChallengeDeciderc B s e Z d Z d „ Z RS( sR On egress: decide whether a challenge needs to be presented
to the user.
c C s d S( sŽ args -> True | False
o 'environ' is the WSGI environment.
o 'status' is the HTTP status as returned by the downstream
WSGI application.
o 'headers' are the headers returned by the downstream WSGI
application.
This interface is responsible for returning True if
a challenge needs to be presented to the user, False otherwise.
N( ( R t statust headers( ( s9 /usr/lib/python2.6/site-packages/repoze/who/interfaces.pyR s ( R R R R ( ( ( s9 /usr/lib/python2.6/site-packages/repoze/who/interfaces.pyR s t IIdentifierc B s) e Z d Z d „ Z d „ Z d „ Z RS( s’
On ingress: Extract credentials from the WSGI environment and
turn them into an identity.
On egress (remember): Conditionally set information in the response headers
allowing the remote system to remember this identity.
On egress (forget): Conditionally set information in the response
headers allowing the remote system to forget this identity (during
a challenge).
c C s d S( sé On ingress:
environ -> { k1 : v1
, ...
, kN : vN
} | None
o 'environ' is the WSGI environment.
o If credentials are found, the returned identity mapping will
contain an arbitrary set of key/value pairs. If the
identity is based on a login and password, the environment
is recommended to contain at least 'login' and 'password'
keys as this provides compatibility between the plugin and
existing authenticator plugins. If the identity can be
'preauthenticated' (e.g. if the userid is embedded in the
identity, such as when we're using ticket-based
authentication), the plugin should set the userid in the
special 'repoze.who.userid' key; no authenticators will be
asked to authenticate the identity thereafer.
o Return None to indicate that the plugin found no appropriate
credentials.
o Only IIdentifier plugins which match one of the the current
request's classifications will be asked to perform
identification.
o An identifier plugin is permitted to add a key to the
environment named 'repoze.who.application', which should be
an arbitrary WSGI application. If an identifier plugin does
so, this application is used instead of the downstream
application set up within the middleware. This feature is
useful for identifier plugins which need to perform
redirection to obtain credentials. If two identifier
plugins add a 'repoze.who.application' WSGI application to
the environment, the last one consulted will"win".
N( ( R ( ( s9 /usr/lib/python2.6/site-packages/repoze/who/interfaces.pyt identify3 s c C s d S( sž On egress (no challenge required):
args -> [ (header-name, header-value), ...] | None
Return a list of headers suitable for allowing the requesting
system to remember the identification information (e.g. a
Set-Cookie header). Return None if no headers need to be set.
These headers will be appended to any headers returned by the
downstream application.
N( ( R t identity( ( s9 /usr/lib/python2.6/site-packages/repoze/who/interfaces.pyt remember[ s c C s d S( s³ On egress (challenge required):
args -> [ (header-name, header-value), ...] | None
Return a list of headers suitable for allowing the requesting
system to forget the identification information (e.g. a
Set-Cookie header with an expires date in the past). Return
None if no headers need to be set. These headers will be
included in the response provided by the challenge app.
N( ( R R
( ( s9 /usr/lib/python2.6/site-packages/repoze/who/interfaces.pyt forgetg s ( R R R R R R ( ( ( s9 /usr/lib/python2.6/site-packages/repoze/who/interfaces.pyR % s ( t IAuthenticatorc B s e Z d Z d „ Z RS( sE On ingress: validate the identity and return a user id or None.
c C s d S( s× identity -> 'userid' | None
o 'environ' is the WSGI environment.
o 'identity' will be a dictionary (with arbitrary keys and
values).
o The IAuthenticator should return a single user id (optimally
a string) if the identity can be authenticated. If the
identify cannot be authenticated, the IAuthenticator should
return None.
Each instance of a registered IAuthenticator plugin that
matches the request classifier will be called N times during a
single request, where N is the number of identities found by
any IIdentifierPlugin instances.
An authenticator must not raise an exception if it is provided
an identity dictionary that it does not understand (e.g. if it
presumes that 'login' and 'password' are keys in the
dictionary, it should check for the existence of these keys
before attempting to do anything; if they don't exist, it
should return None).
An authenticator is permitted to add extra keys to the 'identity'
dictionary (e.g., to save metadata from a database query, rather
than requiring a separate query from an IMetadataProvider plugin).
N( ( R R
( ( s9 /usr/lib/python2.6/site-packages/repoze/who/interfaces.pyt authenticatex s ( R R R R ( ( ( s9 /usr/lib/python2.6/site-packages/repoze/who/interfaces.pyR s s t IChallengerc B s e Z d Z d „ Z RS( só On egress: Conditionally initiate a challenge to the user to
provide credentials.
Only challenge plugins which match one of the the current
response's classifications will be asked to perform a
challenge.
c C s d S( s^ args -> WSGI application or None
o 'environ' is the WSGI environment.
o 'status' is the status written into start_response by the
downstream application.
o 'app_headers' is the headers list written into start_response by the
downstream application.
o 'forget_headers' is a list of headers which must be passed
back in the response in order to perform credentials reset
(logout). These come from the 'forget' method of
IIdentifier plugin used to do the request's identification.
Examine the values passed in and return a WSGI application
(a callable which accepts environ and start_response as its
two positional arguments, ala PEP 333) which causes a
challenge to be performed. Return None to forego performing a
challenge.
N( ( R R t app_headerst forget_headers( ( s9 /usr/lib/python2.6/site-packages/repoze/who/interfaces.pyt challenge s ( R R R R ( ( ( s9 /usr/lib/python2.6/site-packages/repoze/who/interfaces.pyR – s t IMetadataProviderc B s e Z d Z d „ Z RS( s¼ On ingress: When an identity is authenticated, metadata
providers may scribble on the identity dictionary arbitrarily.
Return values from metadata providers are ignored.
c C s d S( sp
Add metadata to the identity (which is a dictionary). One
value is always guaranteed to be in the dictionary when
add_metadata is called: 'repoze.who.userid', representing the
user id of the identity. Availability and composition of
other keys will depend on the identifier plugin which created
the identity.
N( ( R R
( ( s9 /usr/lib/python2.6/site-packages/repoze/who/interfaces.pyt add_metadata¾ s ( R R R R ( ( ( s9 /usr/lib/python2.6/site-packages/repoze/who/interfaces.pyR ¸ s N( t zope.interfaceR R R R R R R R ( ( ( s9 /usr/lib/python2.6/site-packages/repoze/who/interfaces.pyt s N#"