zope.app.security 6.0

认证实用工具的查询视图

常规认证服务不会提供ISourceQueriables接口，但它本身是可查询的，因为它提供了简单的getPrincipals(name)方法。

>>> class Principal:
...     def __init__(self, id):
...         self.id = id

>>> class MyAuthUtility:
...     data = {'jim': Principal(42), 'don': Principal(0),
...             'stephan': Principal(1)}
...
...     def getPrincipals(self, name):
...         return [principal
...                 for id, principal in self.data.items()
...                 if name in id]

现在我们有了可查询的对象，我们为其创建视图。

>>> from zope.app.security.browser.auth import AuthUtilitySearchView
>>> from zope.publisher.browser import TestRequest
>>> request = TestRequest()
>>> view = AuthUtilitySearchView(MyAuthUtility(), request)

这允许我们渲染一个搜索表单。

>>> print(view.render('test')) # doctest: +NORMALIZE_WHITESPACE
<h4>principals.zcml</h4>
<div class="row">
<div class="label">
Search String
</div>
<div class="field">
<input type="text" name="test.searchstring" />
</div>
</div>
<div class="row">
<div class="field">
<input type="submit" name="test.search" value="Search" />
</div>
</div>

如果我们请求结果

>>> view.results('test')

我们不会得到任何结果，因为我们没有提供任何。但如果我们输入

>>> request.form['test.searchstring'] = 'n'

我们仍然得不到任何结果

>>> view.results('test')

因为我们没有按下按钮。所以让我们按下按钮

>>> request.form['test.search'] = 'Search'

这样我们现在就能得到结果了（！）

>>> ids = list(view.results('test'))
>>> ids.sort()
>>> ids
[0, 1]

登录/注销片段

类 LoginLogout

>>> from zope.app.security.browser.auth import LoginLogout

用作视图以生成适合登录或注销的HTML片段，这取决于当前主体是否已通过认证。

当当前主体未认证时，它提供 IUnauthenticatedPrincipal

>>> from zope.authentication.interfaces import IUnauthenticatedPrincipal
>>> from zope.principalregistry.principalregistry import UnauthenticatedPrincipal
>>> anonymous = UnauthenticatedPrincipal('anon', '', '')
>>> IUnauthenticatedPrincipal.providedBy(anonymous)
True

当 LoginLogout 用于具有未认证主体的请求时，它为用户提供一个“登录”链接

>>> from zope.publisher.browser import TestRequest
>>> request = TestRequest()
>>> request.setPrincipal(anonymous)
>>> print(LoginLogout(None, request)())
<a href="@@login.html?nextURL=http%3A//127.0.0.1">[Login]</a>

在此处尝试登录将失败，因为没有对主体进行授权

>>> from zope.app.security.browser.auth import HTTPAuthenticationLogin
>>> login = HTTPAuthenticationLogin()
>>> login.request = request
>>> login.context = None
>>> login.failed = lambda: 'Login Failed'
>>> login.login()
'Login Failed'

有一个安全措施将尝试请求HTTP基本认证

>>> from zope.app.security.browser.auth import HTTPBasicAuthenticationLogin
>>> basic_login = HTTPBasicAuthenticationLogin()
>>> basic_login.request = request
>>> basic_login.failed = lambda: 'Basic Login Failed'
>>> basic_login.login()
'Basic Login Failed'
>>> request._response.getHeader('WWW-Authenticate', literal=True)
'basic realm="Zope"'
>>> request._response.getStatus()
401

当然，未经授权的主体将被确认注销

>>> from zope.app.security.browser.auth import HTTPAuthenticationLogout
>>> logout = HTTPAuthenticationLogout(None, request)
>>> logout.logout(nextURL="bye.html")
'bye.html'
>>> logout.confirmation = lambda: 'Good Bye'
>>> logout.logout()
'Good Bye'

然而，注销的行为不同。并非所有认证协议（即凭证提取器/挑战者）都支持“注销”。此外，我们不知道管理员如何配置Zope的认证。我们的解决方案是依赖管理员明确告诉我们该网站支持注销。

默认情况下，LoginLogout片段不会为未经认证的主体提供注销链接。为了说明，我们将首先设置一个具有未经认证主体的请求

>>> from zope.security.interfaces import IPrincipal
>>> from zope.interface import implementer
>>> @implementer(IPrincipal)
... class Bob:
...     id = 'bob'
...     title = description = ''
>>> bob = Bob()
>>> IUnauthenticatedPrincipal.providedBy(bob)
False
>>> request.setPrincipal(bob)

在这种情况下，默认行为是为片段返回 None

>>> print(LoginLogout(None, request)())
None

此时，登录将正确地将我们导向下一个URL，或确认页面

>>> login = HTTPAuthenticationLogin()
>>> login.request = request
>>> login.context = None
>>> login.login(nextURL='good.html')
>>> login.confirmation = lambda: "You Passed"
>>> login.login()
'You Passed'

同样适用于HTTP基本认证

>>> login = HTTPBasicAuthenticationLogin()
>>> login.request = request
>>> login.context = None
>>> login.confirmation = lambda: "You Passed"
>>> login.login()
'You Passed'

要显示注销提示，管理员必须注册一个提供该接口的标记适配器

>>> from zope.authentication.interfaces import ILogoutSupported

这向LoginLogout标记该网站支持注销。可以注册一个“无操作”适配器来完成此操作

>>> from zope.authentication.logout import LogoutSupported
>>> from zope.component import provideAdapter
>>> provideAdapter(LogoutSupported, (None,), ILogoutSupported)

现在当使用LoginLogout与未经认证的主体时，我们会得到一个注销提示

>>> print(LoginLogout(None, request)())
<a href="@@logout.html?nextURL=http%3A//127.0.0.1">[Logout]</a>

我们可以注销此主体，传递一个要重定向到的URL

>>> logout = HTTPAuthenticationLogout(None, request)
>>> logout.redirect = lambda: 'You have been redirected.'
>>> logout.logout(nextURL="loggedout.html")
'You have been redirected.'

更改