[mod_python] mod_python authentication

Bjorn Sundberg wrote ..
> Hello i'm still a newcomer to mod_python and i have some questions about
> authentication in mod_python.I'm using the publisher with psp templates.
> 
> First of all, i'm trying to get the basic http authentication to work with
> limited success. Some times the promt for the username and password shows
> and some other times it does not. Second thong is that i have creat success
> with the publisher handler authentication "__auth__(), __access__()". My
> questions are, is the publisher handler authentication a basic http
> authentication

Yes.

> and whats the difference between the PythonAuthenHandler
> and the publisher authentication?

They are two different mechanisms for achieving the same end. In one
case all configuration is done within the mod_python publisher code and
mod_python.publisher handles the authentication handshake as necessary.
When you use the mod_python.publisher approach, it can only impose the
authentication on your mod_python.publisher published methods. That is,
if there are other static files in the same directory that Apache is
serving up, they will not fall under the authentication mechanism.

To impose authentication on a whole directory, you will need to do it using
the Apache configuration mechanism. That is, the AuthType/AuthName
directives etc. You should be able to either specify a password database
of some form for Apache to use, or use an authenhandler() for performing
the actual password validation.

> Is there a way do use http digest authentication?

No. HTTP digest authentication and mod_python.publisher are currently
incompatible. See:

  http://issues.apache.org/jira/browse/MODPYTHON-47

It is actually a simple fix, but wasn't done for mod_python 3.2.

Even if fixed, the HTTP digest authentication has to be done by Apache,
it cannot be done by mod_python.publisher when using __auth__ etc.
The fix is merely to stop mod_python.publisher barfing when it is being
done by Apache.
 
Graham