python - Pyramid 安全 - 为未经身份验证的用户添加主体

Question

我正在使用 Pyramid ，我已经设置了非常基本的安全/ACL。我有几个页面想拒绝经过身份验证的用户(注册、登录等)访问，这在我的 acl 中使用它很容易:

(Deny, Authenticated, 'guest'),

问题是，如果我也有这个，它会忽略后面的“拒绝”:

(Allow, Everyone, 'guest'),

所以我的想法是在未经身份验证的用户上添加一个我可以 Hook 的主体(看到有 Authenticated，但没有 Unauthenticated。

def authenticated(userid, request):
    if userid == unauthenticated_userid(request):
        return ['auth:guest']

    user = User.get_by_username(userid)

    if not user:
        None

    if user.admin:
        return ['group:admins', 'group:users']

    return ['group:users']

问题是，如果用户未通过身份验证，AuthTktAuthenticationPolicy 层似乎不会调用回调函数(宁愿只给委托(delegate)人 ['system.Everyone' ] 收工)。

那么，如果有的话，我在这里错过了什么？

下面是完整的 ACL、安全和配置:

class Root(object):
    __name__ = None
    __parent__ = None
    __acl__ = [
        (Allow, Everyone, 'view'),
        (Allow, 'auth:guest', 'guest'),
        (Deny, Authenticated, 'guest'),
        (Allow, Authenticated, 'auth'),
        (Allow, 'group:admins', 'admin'),
    ]

    def __init__(self, request):
        self.request = request

def main(global_config, **settings):
    """ This function returns a Pyramid WSGI application.
    """
    engine = engine_from_config(settings, 'sqlalchemy.')
    DBSession.configure(bind=engine)

    authn_policy = AuthTktAuthenticationPolicy('devdbcookiesig',
                                               callback=authenticated,
                                               hashalg='sha512')
    authz_policy = ACLAuthorizationPolicy()

    Base.metadata.bind = engine
    config = Configurator(settings=settings,
                          root_factory=Root)

    config.set_authentication_policy(authn_policy)
    config.set_authorization_policy(authz_policy)

    config.include('pyramid_chameleon')

    config.add_static_view('static', 'static', cache_max_age=3600)

    config.set_request_property(get_user, 'user', reify=True)

    # ... the rest is standard routing

安全.py:

from model.user import User
from pyramid.security import unauthenticated_userid

def get_user(request):
    # the below line is just an example, use your own method of
    # accessing a database connection here (this could even be another
    # request property such as request.db, implemented using this same
    # pattern).
    userid = unauthenticated_userid(request)
    if userid is not None:
        # this should return None if the user doesn't exist
        # in the database
        return User.get_by_username(userid)

def authenticated(userid, request):
    if userid == unauthenticated_userid(request):
        return ['auth:guest']

    user = User.get_by_username(userid)

    if not user:
        None

    if user.admin:
        return ['group:admins', 'group:users']

    return ['group:users']

最后是错误:

HTTPForbidden: debug_authorization of url http://localhost/signin (view name u'' against context <devdb.Root object at 0x3dd1f10>): ACLDenied permission 'guest' via ACE '<default deny>' in ACL [('Allow', 'system.Everyone', 'view'), ('Allow', 'auth:guest', 'guest'), ('Deny', 'system.Authenticated', 'guest'), ('Allow', 'system.Authenticated', 'auth'), ('Allow', 'group:admins', 'admin')] on context <devdb.Root object at 0x3dd1f10> for principals ['system.Everyone']

Answer 1

想通了(有点)。 ACL 中项目的顺序很重要，所以如果我在为每个人设置允许之前为 guest 设置拒绝身份验证，它会起作用。

__acl__ = [
    (Allow, Everyone, 'view'),
    (Deny, Authenticated, 'guest'),
    (Allow, Everyone, 'guest'),
    (Allow, Authenticated, 'auth'),
    (Allow, 'group:admins', 'admin'),
]

工作时

__acl__ = [
    (Allow, Everyone, 'view'),
    (Allow, Everyone, 'guest'),
    (Deny, Authenticated, 'guest'),
    (Allow, Authenticated, 'auth'),
    (Allow, 'group:admins', 'admin'),
]

不会(经过身份验证的用户在遇到“拒绝身份验证”之前选择“允许所有人”)

仍然没有解决“为什么我不能向未经身份验证的用户添加自定义主体”的问题，但它满足了我的需要。