Teapot: Managing authentication by a third party (Fossil)
Hi, I'm trying to make some test on a distributed wiki provided by Fossil as a backend for storage/auth, Mustache + Material Design Lite for the frontend and Teapot using as middleware for logic and connecting frontend and backend. Teapot is connected with Fossil via JSON and domain objects are stored as Fossil wiki pages. So far the experiment is going well, but now I'm wondering about how to make authentication. In my experiments I use the Fossil user and password to get an auth token that is used via the Fossil's JSON API to make all the operations that require permissions on the repository and now I wonder how this strategy should be implemented for "real" (for the tests, I read the password data from a local temporal file). - There is some User Management Framework or project for Teapot or Zinc, without going to more complex frameworks like Seaside or Aida? - Should I have some "Sessions" object that stores logged users, passwords and/or auth tokens inside the image and deletes them once the user have logoff and/or on a time basis? - Any other strategy or lite user auth framework that I have not thought ? Any advice or experience in dealing with similar scenario is greatly appreciated. Cheers, Offray
IMO it depends on how the API works. Most REST APIs are stateless and the authentication token or api key is sent in each request, there is no login/logout operation. In this case you can setup a before filter and check the authentication token in the filter. If you use normal form based login then using http sessions is the way to go. You can check the session attribute in a before filter similarly, and redirect the user to the login page if there is no session info. Teapot on before: '/secure/*' -> [:req | req session attributeAt: #user ifAbsent: [req abort: (TeaResponse redirect location: '/loginpage')]]; GET: '/loginpage' -> ...show login form... GET: '/secure' -> 'protected'; start. You should clean the session when the user logs out manually. As far as I know ZnServer automatically cleans up inactive sessions after a while, so there is no need to worry about cleanup. -- View this message in context: http://forum.world.st/Teapot-Managing-authentication-by-a-third-party-Fossil... Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com.
participants (2)
-
Attila Magyar -
Offray Vladimir Luna Cárdenas