New Auth Configuration in TG2.2

[Alessandro Molina]

As repoze.what has always seemed a bit over engineered for the needs
of TurboGears2 and being it the source of many dependencies and the
main blocker to supporting repoze.who 2.X I thought that 2.2 could
have been the right time to replace it with something easier to use,
document and customize and which wouldn't require 3 external
dependencies.

I'm going to try to explain how the new auth layer is going to work so
that the community can report any comment before the next 2.2 beta
release.

First of all the new auth layer is compatible with repoze.what
predicates and must be explicitly enabled.
This should avoid breaking past projects that customized the
authorization layer in any way.

Then the new auth layer doesn't replace repoze.who in any way, but
only repoze.what.
This means that identification, remembering, login and so on is still
made by repoze.who and its plugins and projects can continue to
declare their own identifiers, challengers and so on.

The new authentication layer will be used only if
base_config.sa_auth.authmetadata property is set to any value (even
None) inside the app_cfg.py (which is the default for newly
quickstarted projects).
Customizing the new authentication layer should be simpler to
understand and faster for simple customizations related to how your
application handles groups and permissions as those now rely directly
inside your application. For advanced customizations the underlying
repoze.who layer is explicitly exposed and any piece of it can be
changed directly from base_config.sa_auth options.

For anyone interested documentation is available at
https://sourceforge.net/p/turbogears2/tg2docs/ci/bd177b9f54babb119fa7066237af1b54818cde13/tree/docs/main/Auth/Customization.rst
Please read the new doc and If you find any way in which the new auth
layer is worse than the old one let me know it, I'll try to address
any issue before 2.2 release!

[Michael Pedersen]

The only issue I have with it right now is that jenkins is upset about it.

And I'm thinking it might be time to switch where Jenkins is hosted. We need these emails to be working.

--
You received this message because you are subscribed to the Google Groups "TurboGears Trunk" group.
To post to this group, send email to turbogea...@googlegroups.com.
To unsubscribe from this group, send email to turbogears-tru...@googlegroups.com.
For more options, visit this group at http://groups.google.com/group/turbogears-trunk?hl=en.

--
Michael J. Pedersen

My Online Resume: http://www.icelus.org/ -- Google+ http://plus.ly/pedersen

Google Talk: m.ped...@icelus.org -- Twitter: pedersentg

[Alessandro Molina]

Yes I knew about Jenkins, it is due to the fact that it uses a version
of tgext.admin that doesn't support the fact that quickstart creates a
project without repoze.what. Just updating to last tgext.admin commit
should fix it.