This is a pre-production deployment of Warehouse, however changes made here WILL affect the production instance of PyPI.
Latest Version Dependencies status unknown Test status unknown Test coverage unknown
Project Description

NOTE: This is an early version of the code is the library is likely to change.

This is a Pyramid authenitcation plugin for JSON Web Token (JWT) Authentication:

http://self-issued.info/docs/draft-ietf-oauth-json-web-token.html

To access resources using JWT Access Authentication, the client must have obtained a JWT to make signed requests to the server. This library also makes JSON Web Tokens for the client. The Token can be opaque to client although, unless it is encrypted, the client can read the claims made in the token.

When accessing a protected resource, the server will generate a 401 challenge response with the scheme “JWT” as follows:

> GET /protected_resource HTTP/1.1
> Host: example.com

< HTTP/1.1 401 Unauthorized
< WWW-Authenticate: JWT

The client will use their JWT to build a request signature and include it in the Authorization header like so:

> GET /protected_resource HTTP/1.1
> Host: example.com
> Authorization: JWT token=eyJ0eXAiOiJKV1QiLA0KICJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGFt
 cGxlLmNvbS9pc19yb290Ijp0cnVlfQ.dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk

< HTTP/1.1 200 OK
< Content-Type: text/plain
<
< For your eyes only:  secret data!

(NB depending on the number of claims in the JWT the token can get large. For all practical purposes, it should be kept short.)

This plugin uses the PyJWT library for verifying JWTs:

http://github.com/progrium/pyjwt

Also see the library for generating the JWT for the client in the first place although any language can be used to generate it.

Inspiration

This module is heavily based on (and copied from) the Mozilla Services pyramid_macauth package and macauthlib package:

https://github.com/mozilla-services/pyramid_macauth

https://github.com/mozilla-services/macauthlib

Without it, I would not have been able to make the small number of modifications to this package and get it to work with Pyramid.

Licence

This Source Code Form is subject to the terms of the Mozilla Public License, v. 2.0. If a copy of the MPL was not distributed with this file, You can obtain one at http://mozilla.org/MPL/2.0/.

PENDING

  • Initial dev version 0.0.1.dev1.

Forked from https://github.com/mozilla-services/pyramid_macauth version 0.4.0-dev1

0.0.1.dev5

Updated package requires to need PyJWT.

0.0.1.dev4

Updated package so that it can be downloaded for use by Python 3.3/3.4

0.0.1.dev3

Now works properly with RSA keys and fixed issue with not doing a 401 with the appropriate challenge. Dropped support for Python 2.6 and 3.2

0.1.1

Works with PyJWT 0.4.x (also unpinned). Contributions by (Wichert Akkerman <wichert@wiggy.net>) that enable the auth to use a ‘Bearer’ header rather than the custom header ‘JWT’.

Dropped support for Python 3.3 in tox, but it should still work fine.

Addition (from development) perspective of using Vagrant to develop and tox-test the package against python 2.7 and 3.4

0.1.2

Added ability to disable various checks via the PyJWT options{} in the decode() method. This is configured in the policy via the Pyramid setting system.

0.1.3

Merged PR#11 from Shadizzle to provide ability to configure ‘scheme’ from the INI file. Bumped version to 0.1.3.

Release History

Release History

0.1.3

This version

History Node

TODO: Figure out how to actually get changelog content.

Changelog content for this version goes here.

Donec et mollis dolor. Praesent et diam eget libero egestas mattis sit amet vitae augue. Nam tincidunt congue enim, ut porta lorem lacinia consectetur. Donec ut libero sed arcu vehicula ultricies a non tortor. Lorem ipsum dolor sit amet, consectetur adipiscing elit.

Show More

0.1.2

History Node

TODO: Figure out how to actually get changelog content.

Changelog content for this version goes here.

Donec et mollis dolor. Praesent et diam eget libero egestas mattis sit amet vitae augue. Nam tincidunt congue enim, ut porta lorem lacinia consectetur. Donec ut libero sed arcu vehicula ultricies a non tortor. Lorem ipsum dolor sit amet, consectetur adipiscing elit.

Show More

0.1.1

History Node

TODO: Figure out how to actually get changelog content.

Changelog content for this version goes here.

Donec et mollis dolor. Praesent et diam eget libero egestas mattis sit amet vitae augue. Nam tincidunt congue enim, ut porta lorem lacinia consectetur. Donec ut libero sed arcu vehicula ultricies a non tortor. Lorem ipsum dolor sit amet, consectetur adipiscing elit.

Show More

0.1.0

History Node

TODO: Figure out how to actually get changelog content.

Changelog content for this version goes here.

Donec et mollis dolor. Praesent et diam eget libero egestas mattis sit amet vitae augue. Nam tincidunt congue enim, ut porta lorem lacinia consectetur. Donec ut libero sed arcu vehicula ultricies a non tortor. Lorem ipsum dolor sit amet, consectetur adipiscing elit.

Show More

0.0.1.dev5

History Node

TODO: Figure out how to actually get changelog content.

Changelog content for this version goes here.

Donec et mollis dolor. Praesent et diam eget libero egestas mattis sit amet vitae augue. Nam tincidunt congue enim, ut porta lorem lacinia consectetur. Donec ut libero sed arcu vehicula ultricies a non tortor. Lorem ipsum dolor sit amet, consectetur adipiscing elit.

Show More

Download Files

Download Files

TODO: Brief introduction on what you do with files - including link to relevant help section.

File Name & Checksum SHA256 Checksum Help Version File Type Upload Date
pyramid_jwtauth-0.1.3.tar.gz (19.1 kB) Copy SHA256 Checksum SHA256 Source Jul 27, 2015

Supported By

WebFaction WebFaction Technical Writing Elastic Elastic Search Pingdom Pingdom Monitoring Dyn Dyn DNS Sentry Sentry Error Logging CloudAMQP CloudAMQP RabbitMQ Heroku Heroku PaaS Kabu Creative Kabu Creative UX & Design Fastly Fastly CDN DigiCert DigiCert EV Certificate Rackspace Rackspace Cloud Servers DreamHost DreamHost Log Hosting