Package pyxmpp :: Package sasl :: Module core :: Class PasswordManager
[show private | hide private]
[frames | no frames]

Class PasswordManager

Known Subclasses:
StreamSASLMixIn

Base class for password managers.

Password manager is an object responsible for providing or verification of authentication credentials.

All the methods of PasswordManager class may be overriden in derived classes for specific authentication and authorization policy.


Method Summary
  __init__(self)
Initialize a PasswordManager object.
bool check_authzid(self, authzid, extra_info)
Check if the authenticated entity is allowed to use given authorization id.
bool check_password(self, username, password, realm)
Check the password validity.
unicode choose_realm(self, realm_list)
Choose an authentication realm from the list provided by the server.
str generate_nonce(self)
Generate a random string for digest authentication challenges.
unicode,`str` tuple. get_password(self, username, realm, acceptable_formats)
Get the password for user authentication.
list of unicode get_realms(self)
Get available realms list.
  get_serv_host(self)
Return the host name for DIGEST-MD5 'digest-uri' field.
  get_serv_name(self)
Return the service name for DIGEST-MD5 'digest-uri' field.
  get_serv_type(self)
Return the service type for DIGEST-MD5 'digest-uri' field.

Method Details

__init__(self)
(Constructor)

Initialize a PasswordManager object.

check_authzid(self, authzid, extra_info=None)

Check if the authenticated entity is allowed to use given authorization id.

[server only]

By default return True if the authzid is None or empty or it is equal to extra_info["username"] (if the latter is present).

Parameters:
authzid - an authorization id.
           (type=unicode)
extra_info - information about an entity got during the authentication process. This is a mapping with arbitrary, mechanism-dependent items. Common keys are 'username' or 'realm'.
           (type=mapping)
Returns:
True if the authenticated entity is authorized to use the provided authorization id.
           (type=bool)

check_password(self, username, password, realm=None)

Check the password validity.

[server only]

Used by plain-text authentication mechanisms.

Retrieve a "plain" password for the username and realm using self.get_password and compare it with the password provided.

May be overrided e.g. to check the password against some external authentication mechanism (PAM, LDAP, etc.).

Parameters:
username - the username for which the password verification is requested.
           (type=unicode)
password - the password to verify.
           (type=unicode)
realm - the authentication realm for which the password verification is requested.
           (type=unicode)
Returns:
True if the password is valid.
           (type=bool)

choose_realm(self, realm_list)

Choose an authentication realm from the list provided by the server.

[client only]

By default return the first realm from the list or None if the list is empty.

Parameters:
realm_list - the list of realms provided by a server.
           (type=sequence of unicode)
Returns:
the realm chosen.
           (type=unicode)

generate_nonce(self)

Generate a random string for digest authentication challenges.

The string should be cryptographicaly secure random pattern.

Returns:
the string generated.
           (type=str)

get_password(self, username, realm=None, acceptable_formats=('plain',))

Get the password for user authentication.

[both client or server]

By default returns (None, None) providing no password. Should be overriden in derived classes.

Parameters:
username - the username for which the password is requested.
           (type=unicode)
realm - the authentication realm for which the password is requested.
           (type=unicode)
acceptable_formats - a sequence of acceptable formats of the password data. Could be "plain", "md5:user:realm:password" or any other mechanism-specific encoding. This allows non-plain-text storage of passwords. But only "plain" format will work with all password authentication mechanisms.
           (type=sequence of str)
Returns:
the password and its encoding (format).
           (type=unicode,`str` tuple.)

get_realms(self)

Get available realms list.

[server only]

Returns:
a list of realms available for authentication. May be empty -- the client may choose its own realm then or use no realm at all.
           (type=list of unicode)

get_serv_host(self)

Return the host name for DIGEST-MD5 'digest-uri' field.

Should be overriden in derived classes.

Returns:
the host name ("unknown" by default)

get_serv_name(self)

Return the service name for DIGEST-MD5 'digest-uri' field.

Should be overriden in derived classes.

Returns:
the service name or None (which is the default).

get_serv_type(self)

Return the service type for DIGEST-MD5 'digest-uri' field.

Should be overriden in derived classes.

Returns:
the service type ("unknown" by default)