Received: by 10.180.107.199 with SMTP id he7mr1867412wib.1.1347902093201;
        Mon, 17 Sep 2012 10:14:53 -0700 (PDT)
X-BeenThere: turbogears-trunk@googlegroups.com
Received: by 10.216.202.99 with SMTP id c77ls8826399weo.6.gmail; Mon, 17 Sep
 2012 10:14:52 -0700 (PDT)
Received: by 10.180.82.226 with SMTP id l2mr1840022wiy.1.1347902092139;
        Mon, 17 Sep 2012 10:14:52 -0700 (PDT)
Received: by 10.180.82.226 with SMTP id l2mr1840021wiy.1.1347902092130;
        Mon, 17 Sep 2012 10:14:52 -0700 (PDT)
Return-Path: <c...@online.de>
Received: from relay2.uni-heidelberg.de (relay2.uni-heidelberg.de. [129.206.210.211])
        by gmr-mx.google.com with ESMTPS id fa8si1963180wid.1.2012.09.17.10.14.52
        (version=TLSv1/SSLv3 cipher=OTHER);
        Mon, 17 Sep 2012 10:14:52 -0700 (PDT)
Received-SPF: neutral (google.com: 129.206.210.211 is neither permitted nor denied by best guess record for domain of c...@online.de) client-ip=129.206.210.211;
Authentication-Results: gmr-mx.google.com; spf=neutral (google.com: 129.206.210.211 is neither permitted nor denied by best guess record for domain of c...@online.de) smtp.mail=c...@online.de
Received: from ix.urz.uni-heidelberg.de (cyrus-portal.urz.uni-heidelberg.de [129.206.100.176])
	by relay2.uni-heidelberg.de (8.13.8/8.13.8) with ESMTP id q8HHEpOT024573
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <turbogears-trunk@googlegroups.com>; Mon, 17 Sep 2012 19:14:51 +0200
Received: from extmail.urz.uni-heidelberg.de (extmail.urz.uni-heidelberg.de [129.206.100.140])
	by ix.urz.uni-heidelberg.de (8.13.8/8.13.8) with ESMTP id q8HHEpAb023261
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <turbogears-trunk@googlegroups.com>; Mon, 17 Sep 2012 19:14:51 +0200
Received: from [172.17.31.39] ([147.142.78.204])
	by extmail.urz.uni-heidelberg.de (8.13.4/8.13.1) with ESMTP id q8HHEot9009680
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <turbogears-trunk@googlegroups.com>; Mon, 17 Sep 2012 19:14:50 +0200
Message-ID: <50575AF2.2070...@online.de>
Date: Mon, 17 Sep 2012 19:16:34 +0200
From: Christoph Zwerschke <c...@online.de>
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:15.0) Gecko/20120907 Thunderbird/15.0.1
MIME-Version: 1.0
To: TurboGears Trunk <turbogears-trunk@googlegroups.com>
Subject: TurboGears 2.2 and authentication
Content-Type: text/plain; charset=ISO-8859-15; format=flowed
Content-Transfer-Encoding: 7bit

While upgrading a project from TG 2.1 to 2.2 I noticed that the 
"authenticators" setting (a list of custom authenticators) is handled 
differently depending on whether "authmetadata" is defined ("new-style 
config") or not ("old style").

In new-style configuration, the default authenticator will not be used 
at all when custom authenticators are specified, while in old-style 
configuration, the default authenticator will be appended.

I think we should re-establish the old behavior. It often makes sense to 
prepend additional authenticators to the default one. Of course, you can 
always add the default one manually, but it's cumbersome.

Or, we could make it even more flexible by allowing a value of 
('default', None) in the "authenticators" list which will be 
automatically replaced by the default authenticator. That way you can 
specify exactly the position of the authenticator in the chain. I have 
already created a patch for this, let me know what you think.

-- Christoph