Configurable regex (option) for TracStandalone server auth

[Olemis Lang <olemis+trac@…>]

We have been discussing in dev@bloodhound.apache.org that it'd be useful to add an option in TracStandalone server in order to supply a regex meant to match URL path tracd auth authentication middlewares should act upon. We'd like to rely upon such new feature in spite of been able to write functional test cases combining both RPC requests as well as browser interaction.

At present if --auth option is activated then ​trachacks:AccountManagerPlugin login form will not be accessible since at that path (digest) auth will be enforced to require valid user. OTOH if the aforementioned option is not set then RPC requests will not be autenticated.

The original discussion is archived here ​http://goo.gl/PQgKOL

[Ryan J Ollos]

I don't fully understand the issue yet, but maybe seeing the patch will help with that.

[olemis]

Replying to rjollos:

I don't fully understand the issue yet, but maybe seeing the patch will help with that.

See ​this patch . After applying it e.g. by running tracd this way

$ tracd --hostname=localhost -r -p 8083 --basic-auth="env,/path/to/trac/.htpasswd,trac" /path/to/trac/env/ --auth-regex="^/login/.*$"

1. anonymous access to /login is allowed e.g. to render ​AccountManagerPlugin login form
2. auth will be enforced for sub-paths e.g. /login/rpc for ​XmlRpcPlugin

I tested the patch against both trunk and 1.0-stable and it works.

[Jun Omae]

I don't think that is good idea to add the option which regular expression is used.

We could change to require authentication for /login/* also.

trac/web/auth.py

@@ -108 +108 @@
     # IRequestHandler methods
 
     def match_request(self, req):
-        return re.match('/(login|logout)/?$', req.path_info)
+        if req.path_info in ('/login', '/logout', '/logout/'):
+            return True
+        return req.path_info.startswith('/login/')
 
     def process_request(self, req):
         if req.path_info.startswith('/login'):

[Olemis Lang <olemis+trac@…>]

Replying to jomae:

I don't think that is good idea to add the option which regular expression is used.

We could change to require authentication for /login/* also.

[…]

IMO under certain conditions this will be either unsuitable (enforce no login as usual) or insufficient (e.g. Bloodhound product URL namespace, especially using custom web bootstrap handlers)