Pyramid 内置的身份验证/授权可以实现复杂的安全方案吗？
看起来安全模型适合非常小的项目，但是在 security.py 中写入所有可能的注册用户的哈希密码可能是不可行的。您是否知道扩大 Pyramid 身份验证的任何示例，或者通过 Pyramid 的安全方案调用我自己的安全信息数据库有什么好处吗？
It seems like the security model fits very small projects, but that it is probably not feasible to write all possible registered users' hashed passwords in security.py. Do you know any examples of scaling up Pyramid's authentication, or are there any benefits to calling through Pyramid's security scheme into my own database of security information?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
我不认为项目的规模与安全模型有关。您想要一个简单或复杂的安全模型。两者都可以应用于任何规模的项目。 Pyramid 的优点之一是它的可扩展性。
为什么要将散列密码存储在
security.py中？ （cmiiw 这里，我可能误解了）如果你在某人的代码上读到这个，那可能只是一个例子。在真实的应用程序中，您将它们保存在您选择的存储/持久性系统中。再说一次，我不明白你所说的“扩大身份验证”是什么意思。我猜你想要一些工作示例：
I dont think the size of the project is related to the security model. Either you want a simple or a complex security model. Both can be applied to projects of any size. One of Pyramid's strong points is its extensibility.
Why would you store hashed passwords in
security.py? (cmiiw here, I probably misunderstood) If you read this on someone's code, that's probably just an example. In real apps, you save them in a storage/persistence system of your choice.Again, I don't understand what you mean by "scaling up authentication". My guess is you want some working examples:
不知道您的需求是什么，也不知道“扩大安全性”是什么意思，但金字塔身份验证策略非常灵活。您需要了解，虽然它不维护用户和密码，但它仅提供一种从传入请求中获取用户标识符的机制。例如， AuthTktAuthenticationPolicy 会跟踪您使用记住方法设置的 cookie 的用户 ID。
您从该用户 ID 中获得哪些有意义的信息完全取决于您，并且是特定于应用程序的。
因此，您可能真正想问的问题是您的应用程序能否“扩展安全性”。
我无法向您展示代码，因为它是专有的，但我需要在同一应用程序上支持 openid、http auth 和典型的数据库支持的用户存储，而且用户存储在不同的数据库分片中并且分片可以额外增加复杂性不能立即确定。只需很少的代码即可支持这一点。
No idea what your needs are or what you mean by "scaling up security", but pyramids authentication policy is very flexible. You need to understand though that it doesn't maintain users and passwords it merely provides a mechanism for obtaining a user identifier from the incoming request. For example, the AuthTktAuthenticationPolicy keeps track of the user id by cookie that you set using the remember method.
What meaningful information you derive from that user id is totally up to you and is application specific.
So really the question you may want to ask is can your application "scale up security".
I can't show you code because it's proprietary but I've needed to support openid, http auth and your typical db backed user store on the same application, with the extra added complication that users are stored in different database shards and the shard can't be immediately determined. It takes very little code to support this.
我最终为自己构建了一些东西，如果您碰巧使用 MongoDB，它可以使身份验证变得更容易一些。
https://github.com/mosesn/mongauth
它没有内置到金字塔中，但很容易挂钩足够的。一切都非常透明。
I ended up building something for myself that makes authentication a little easier if you happen to be using MongoDB.
https://github.com/mosesn/mongauth
It isn't built into pyramid, but hooks in easily enough. Everything is pretty transparent.