从未调用Pyramid AuthTktAuthenticationPolicy回调

Question

你知道吗 我试图通过使用AuthTktAuthenticationPolicy在金字塔中实现简单的身份验证。我跟随this - authentication和this - authorization。你知道吗

你知道吗 初始化.py

from pyramid.config import Configurator

from pyramid.authentication import AuthTktAuthenticationPolicy
from pyramid.authorization import ACLAuthorizationPolicy
from .security import groupfinder, Root


def main(global_config, **settings):
    """ This function returns a Pyramid WSGI application.
    """
    #config = Configurator(settings=settings)

    # ACL
    config = Configurator(settings=settings, root_factory=Root)
    authn_policy = AuthTktAuthenticationPolicy('sosecret', callback=groupfinder, hashalg='sha512')
    authz_policy = ACLAuthorizationPolicy()
    config.set_authentication_policy(authn_policy)
    config.set_authorization_policy(authz_policy)

    config.include('pyramid_jinja2')
    config.include('.models')
    config.include('.routes')
    config.scan()
    return config.make_wsgi_app()

你知道吗安全.py你知道吗

GROUPS = {'admin': ['group:admin']}
USERS = {'receptionist' : 'receptionist'}

def groupfinder(userid, request):
    print("It's here")
    return ['group:admin']

from pyramid.security import Allow, Everyone

class Root(object):
    def __acl__(self):
        return [(Allow, Everyone, 'view'), (Allow, 'group:admin', 'edit')]

def __init__(self, request):
    pass

我的观点默认.py你知道吗

...

@view_config(route_name='login', renderer='../templates/login.jinja2')
def login(request):
    try:
        if not ('user_name' in request.params and 'password' in request.params):
            return {}

        if request.params['user_name'] == '' or request.params['password'] == '':
            raise Exception('Ada inputan yang kosong dari form')

        match_ = request.dbsession.query(TblUser).filter_by(user_name=request.params['user_name'], user_password=request.params['password']).one()
        username = request.params['user_name']

        if match_ is not None:
            headers = remember(request, username)
            request.response.headerlist.extend(headers)
            next_url = request.route_url('search-room')

            return HTTPFound(location=next_url)

    except Exception as e:
        log.exception(str(e))
        return {'code' : 'error', 'message' : str(e) }

...

@view_config(route_name='search-room', renderer='../templates/search-room.jinja2', permission='edit')
def search_room(request):
    try:
        if not ('floor' in request.params):
            return {}

        if request.params['floor'] == '':
            raise Exception('Ada inputan yang kosong dari form')

        query = request.dbsession.query(TblReservation)
        result = query.join(TblRoom, aliased=True).filter_by(room_floor=request.params['floor']).all()

        if result is None or len(result) < 1:
            raise Exception("No row found")

        return {'code' : 'ok', 'message' : '', 'content' : result }

    except Exception as e:
        log.exception(str(e))
        return {'code' : 'error', 'message' : str(e), 'content' : ''}

回购中的完整代码https://github.com/muhakbaryasin/pyramid-simple-acl

你知道吗 我设置至少用户需要被认证和授权为'管理员'，这样它就可以得到'编辑'的角色和访问'搜索室'页。你知道吗

你知道吗 我现在得到的是登录过程已经完成，但它不会授予访问“搜索室”的权限，而且从不调用groupfinder。你知道吗

我错过了什么？：（

Answer 1

对source in the Pyramid Quick Tutorial运行一个diff来查找您遗漏的内容。你知道吗