41.2. HELPER CLASSES

41.2 Helper Classes

See pyramid.authentication.AuthTktAuthenticationPolicy for the meanings of the constructor arguments.

class AuthTicket(secret, userid, ip, tokens=(), user_data=’‘, time=None,

cookie_name=’auth_tkt’, secure=False)

This class represents an authentication token. You must pass in the shared secret, the userid, and the IP address. Optionally you can include tokens (a list of strings, representing role names), ‘user_data’, which is arbitrary data available for your own use in later scripts. Lastly, you can override the cookie name and timestamp.

Once you provide all the arguments, use .cookie_value() to generate the appropriate authentication ticket.

Usage:

token = AuthTicket(’sharedsecret’, ’username’, os.environ[’REMOTE_ADDR’], tokens=[’admin’])

val = token.cookie_value()

exception AuthTktCookieHelper.BadTicket(msg, expected=None)

Exception raised when a ticket can’t be parsed. If we get far enough to determine what the expected digest should have been, expected is set. This should not be shown by default, but can be useful for debugging.

AuthTktCookieHelper.forget(request)

Return a set of expires Set-Cookie headers, which will destroy any existing auth_tkt cookie when attached to a response

AuthTktCookieHelper.identify(request)

Return a dictionary with authentication information, or None if no valid auth_tkt is attached to request

513

41. PYRAMID.AUTHENTICATION

static AuthTktCookieHelper.parse_ticket(secret, ticket, ip)

Parse the ticket, returning (timestamp, userid, tokens, user_data).

If the ticket cannot be parsed, a BadTicket exception will be raised with an explanation.

AuthTktCookieHelper.remember(request, userid, max_age=None, to-

kens=())

Return a set of Set-Cookie headers; when set into a response, these headers will represent a valid authentication ticket.

max_age The max age of the auth_tkt cookie, in seconds. When this value is set, the cookie’s Max-Age and Expires settings will be set, allowing the auth_tkt cookie to last between browser sessions. If this value is None, the max_age value provided to the helper itself will be used as the max_age value. Default: None.

tokens A sequence of strings that will be placed into the auth_tkt tokens field. Each string in the sequence must be of the Python str type and must match the regex ^[A-Za-z][A-Za-z0-9+_-]*$. Tokens are available in the returned identity when an auth_tkt is found in the request and unpacked. Default:

().

514