Mora Authentication about mora HOT 7 CLOSED

Sorry about replying to this issue this late.

Do you think Mora should perform such authentication (it already can do Mongo auth)? Another option is put such a service in front of Mora. Apache and Nginx both could perform this task.

from mora.

I think mora is actually well performing HTTP server in it's current form and users should have an option to use authentication in it. Also it is a problem for PaaS users who doesn't always have possibility to configure loadbalancer or any intermediary server in infrastructure in such way.

from mora.

in the past, i have used HMAC to protect an Api. Kind of the way Amazon AWS
apis are accessible. Another feature that spings to mind is rate-limiting.
What kinds of schemes were you thinking of? We could provide filter
implementations to Mora for the user to configure.

On Monday, March 10, 2014, Łukasz Kurowski [email protected] wrote:

I think mora is actually well performing HTTP server in it's current form
and users should have an option to use authentication in it. Also it is a
problem for PaaS users who doesn't always have possibility to configure
loadbalancer or any intermediary server in infrastructure in such way.

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/18#issuecomment-37192323
.

^ Ernest Micklei

http://ernestmicklei.com

from mora.

Yes, I think we should provide few basic filters which could be enabled in configuration file.

Example config section:

mora.filters = basic_auth,other_defined
mora.filters.basic_auth.username = admin
mora.filters.basic_auth.password = password

example implementation

var registeredFilers map[string](func(p properties.Properties) func(req *restful.Request, resp *restful.Response))

func init() {
    // basic authentication filter
    registeredFilters["basic_auth"] = func(p properties.Properties) func(req *restful.Request, resp *restful.Response) {
        var (
            username = p.GetString("username", "")
            password = p.GetString("password", "")
        )

        return func(req *restful.Request, resp *restful.Response) {
            // authenticate here
        }
    }
}

func initializeRouter() { //proto
    filters := strings.Split(props.GetString("mora.filters"), ",")

    for _, name := range filters {
        if filter := registeredFilters[name]; filter != nil {
            fn := filter(props.SelectProperties(fmt.Sprintf("mora.filters.%s", name)))
            route.Filter(fn)
        }
    }
}

from mora.

good idea to have filter implementations and let users configure their
settings.

The hard part is to think about what filters to offer.

On Monday, March 10, 2014, Łukasz Kurowski [email protected] wrote:

Yes, I think we should provide few basic filters which could be enabled in
configuration file.

Example config section:

mora.filters = basic_auth,other_definedmora.filters.basic_auth.username = adminmora.filters.basic_auth.password = password

example implementation

var registeredFilers map[string](func%28p properties.Properties%29 func%28req *restful.Request, resp *restful.Response%29)
func init() {
// basic authentication filter
registeredFilters["basic_auth"] = func(p properties.Properties) func(req *restful.Request, resp *restful.Response) {
var username, password = p.GetString("username", ""), p.GetString("password", "")

    return func(req *restful.Request, resp *restful.Response) {
        // authenticate here
    }
}}

func initializeRouter() { //proto
filters := strings.Split(props.GetString("mora.filters"), "")

for _, name := range filters {
    if filter := registeredFilters[name]; filter != nil {
        fn := filter(props.SelectProperties(fmt.Sprintf("mora.filters.%s", name)))
        route.Filter(fn)
    }
}}

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/18#issuecomment-37215140
.

^ Ernest Micklei

http://ernestmicklei.com

from mora.

I think just basic auth should be fine for now. IMO we should create a new directory which will contain one filter per file so it would be easy to make a new one for any contributor without digging into any additional code.

from mora.

Along the vision of the new structure, we could have a subpkg contains auth method implementations.

from mora.