docs/narr/settings.rst
author Christophe de Vienne <christophe@unlish.com>
Wed, 25 Feb 2015 22:40:39 +0100
changeset 11565 6398be12f8e6
parent 11555 03db03f5c303
child 11587 18dd303225cd
permissions -rw-r--r--
[doc] Document the new authentication stack
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
11537
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
     1
Settings
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
     2
========
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
     3
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
     4
.. _cubicweb_settings:
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
     5
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
     6
Cubicweb Settings
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
     7
-----------------
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
     8
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
     9
Pyramid CubicWeb will make use of the following configuration entries if found
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    10
in the cubicweb configuration (a.k.a. `all-in-one.conf`):
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    11
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    12
.. warning::
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    13
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    14
    These settings requires the `pyramid` cube to be enabled on the instance.
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    15
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    16
.. confval:: pyramid-session-secret
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    17
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    18
    Secret phrase to sign the session cookie
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    19
    
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    20
    Used by :func:`pyramid_cubicweb.session.includeme` to configure the default session factory.
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    21
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    22
    .. code-block:: ini
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    23
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    24
        pyramid-session-secret = <some very secret passphrase>
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    25
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    26
.. confval:: pyramid-auth-secret
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    27
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    28
    Secret phrase to sign the authentication cookie
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    29
    
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    30
    Used by :func:`pyramid_cubicweb.auth.includeme` to configure the default authentication policy.
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    31
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    32
    .. code-block:: ini
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    33
11555
03db03f5c303 [doc] fix pyramid-auth-secret conf sample
Christophe de Vienne <christophe@unlish.com>
parents: 11537
diff changeset
    34
        pyramid-auth-secret = <some other very secret passphrase>
11537
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    35
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    36
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    37
.. _pyramid_settings:
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    38
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    39
Pyramid Settings
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    40
----------------
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    41
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    42
If a ``pyramid.ini`` file is found in the instance home directory (where the
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    43
``all-in-one.conf`` file is), its ``[main]`` section will be read and used as the
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    44
``settings`` of the pyramid Configurator.
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    45
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    46
This configuration file is almost the same as the one read by ``pserve``, which
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    47
allow to easily add any pyramid extension and configure it.
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    48
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    49
A typical ``pyramid.ini`` file is:
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    50
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    51
.. code-block:: ini
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    52
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    53
    [main]
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    54
    pyramid.includes =
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    55
        pyramid_redis_sessions
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    56
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    57
    cubicweb.defaults = no
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    58
    cubicweb.includes =
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    59
        pyramid_cubicweb.auth
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    60
        pyramid_cubicweb.login
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    61
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    62
    cubicweb.profile = no
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    63
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    64
    redis.sessions.secret = your_cookie_signing_secret
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    65
    redis.sessions.timeout = 1200
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    66
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    67
    redis.sessions.host = mywheezy
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    68
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    69
The Pyramid CubicWeb specific configuration entries are:
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    70
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    71
.. confval:: cubicweb.includes (list)
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    72
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    73
    Same as ``pyramid.includes``, but the includes are done after the cubicweb
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    74
    specific registry entries are initialized.
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    75
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    76
    Useful to include extensions that requires these entries.
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    77
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    78
.. confval:: cubicweb.bwcompat (bool)
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    79
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    80
    (True) Enable/disable backward compatibility. See :ref:`bwcompat_module`.
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    81
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    82
.. confval:: cubicweb.defaults (bool)
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    83
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    84
    (True) Enable/disable defaults. See :ref:`defaults_module`.
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    85
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    86
.. confval:: cubicweb.profile (bool)
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    87
caf268942436 Initial documentation.
Christophe de Vienne <christophe@unlish.com>
parents:
diff changeset
    88
    (False) Enable/disable profiling. See :ref:`profiling`.
11565
6398be12f8e6 [doc] Document the new authentication stack
Christophe de Vienne <christophe@unlish.com>
parents: 11555
diff changeset
    89
6398be12f8e6 [doc] Document the new authentication stack
Christophe de Vienne <christophe@unlish.com>
parents: 11555
diff changeset
    90
.. confval:: cubicweb.auth.update_login_time (bool)
6398be12f8e6 [doc] Document the new authentication stack
Christophe de Vienne <christophe@unlish.com>
parents: 11555
diff changeset
    91
6398be12f8e6 [doc] Document the new authentication stack
Christophe de Vienne <christophe@unlish.com>
parents: 11555
diff changeset
    92
    (True) Add a :class:`pyramid_cubicweb.auth.UpdateLoginTimeAuthenticationPolicy`
6398be12f8e6 [doc] Document the new authentication stack
Christophe de Vienne <christophe@unlish.com>
parents: 11555
diff changeset
    93
    policy, that update the CWUser.login_time attribute when a user login.
6398be12f8e6 [doc] Document the new authentication stack
Christophe de Vienne <christophe@unlish.com>
parents: 11555
diff changeset
    94
    
6398be12f8e6 [doc] Document the new authentication stack
Christophe de Vienne <christophe@unlish.com>
parents: 11555
diff changeset
    95
.. confval:: cubicweb.auth.authtkt (bool)
6398be12f8e6 [doc] Document the new authentication stack
Christophe de Vienne <christophe@unlish.com>
parents: 11555
diff changeset
    96
6398be12f8e6 [doc] Document the new authentication stack
Christophe de Vienne <christophe@unlish.com>
parents: 11555
diff changeset
    97
    (True) Enables the 2 cookie-base auth policies, which activate/deactivate
6398be12f8e6 [doc] Document the new authentication stack
Christophe de Vienne <christophe@unlish.com>
parents: 11555
diff changeset
    98
    depending on the `persistent` argument passed to `remember`.
6398be12f8e6 [doc] Document the new authentication stack
Christophe de Vienne <christophe@unlish.com>
parents: 11555
diff changeset
    99
6398be12f8e6 [doc] Document the new authentication stack
Christophe de Vienne <christophe@unlish.com>
parents: 11555
diff changeset
   100
    The default login views set persistent to True if a `__setauthcookie`
6398be12f8e6 [doc] Document the new authentication stack
Christophe de Vienne <christophe@unlish.com>
parents: 11555
diff changeset
   101
    parameters is passed to them, and evals to True in
6398be12f8e6 [doc] Document the new authentication stack
Christophe de Vienne <christophe@unlish.com>
parents: 11555
diff changeset
   102
    :func:`pyramid.settings.asbool`.
6398be12f8e6 [doc] Document the new authentication stack
Christophe de Vienne <christophe@unlish.com>
parents: 11555
diff changeset
   103
6398be12f8e6 [doc] Document the new authentication stack
Christophe de Vienne <christophe@unlish.com>
parents: 11555
diff changeset
   104
    The configuration values of the policies are arguments for
6398be12f8e6 [doc] Document the new authentication stack
Christophe de Vienne <christophe@unlish.com>
parents: 11555
diff changeset
   105
    :class:`pyramid.authentication.AuthTktAuthenticationPolicy`.
6398be12f8e6 [doc] Document the new authentication stack
Christophe de Vienne <christophe@unlish.com>
parents: 11555
diff changeset
   106
6398be12f8e6 [doc] Document the new authentication stack
Christophe de Vienne <christophe@unlish.com>
parents: 11555
diff changeset
   107
    The first policy handles session authentication. It doesn't get
6398be12f8e6 [doc] Document the new authentication stack
Christophe de Vienne <christophe@unlish.com>
parents: 11555
diff changeset
   108
    activated if `remember()` is called with `persistent=False`:
6398be12f8e6 [doc] Document the new authentication stack
Christophe de Vienne <christophe@unlish.com>
parents: 11555
diff changeset
   109
6398be12f8e6 [doc] Document the new authentication stack
Christophe de Vienne <christophe@unlish.com>
parents: 11555
diff changeset
   110
    .. confval:: cubicweb.auth.authtkt.session.cookie_name (str)
6398be12f8e6 [doc] Document the new authentication stack
Christophe de Vienne <christophe@unlish.com>
parents: 11555
diff changeset
   111
6398be12f8e6 [doc] Document the new authentication stack
Christophe de Vienne <christophe@unlish.com>
parents: 11555
diff changeset
   112
        ('auth_tkt') The cookie name. Must be different from the persistent
6398be12f8e6 [doc] Document the new authentication stack
Christophe de Vienne <christophe@unlish.com>
parents: 11555
diff changeset
   113
        authentication cookie name.
6398be12f8e6 [doc] Document the new authentication stack
Christophe de Vienne <christophe@unlish.com>
parents: 11555
diff changeset
   114
6398be12f8e6 [doc] Document the new authentication stack
Christophe de Vienne <christophe@unlish.com>
parents: 11555
diff changeset
   115
    .. confval:: cubicweb.auth.authtkt.session.timeout (int)
6398be12f8e6 [doc] Document the new authentication stack
Christophe de Vienne <christophe@unlish.com>
parents: 11555
diff changeset
   116
6398be12f8e6 [doc] Document the new authentication stack
Christophe de Vienne <christophe@unlish.com>
parents: 11555
diff changeset
   117
        (1200) Cookie timeout.
6398be12f8e6 [doc] Document the new authentication stack
Christophe de Vienne <christophe@unlish.com>
parents: 11555
diff changeset
   118
6398be12f8e6 [doc] Document the new authentication stack
Christophe de Vienne <christophe@unlish.com>
parents: 11555
diff changeset
   119
    .. confval:: cubicweb.auth.authtkt.session.reissue_time (int)
6398be12f8e6 [doc] Document the new authentication stack
Christophe de Vienne <christophe@unlish.com>
parents: 11555
diff changeset
   120
6398be12f8e6 [doc] Document the new authentication stack
Christophe de Vienne <christophe@unlish.com>
parents: 11555
diff changeset
   121
        (120) Reissue time.
6398be12f8e6 [doc] Document the new authentication stack
Christophe de Vienne <christophe@unlish.com>
parents: 11555
diff changeset
   122
6398be12f8e6 [doc] Document the new authentication stack
Christophe de Vienne <christophe@unlish.com>
parents: 11555
diff changeset
   123
    The second policy handles persistent authentication. It doesn't get
6398be12f8e6 [doc] Document the new authentication stack
Christophe de Vienne <christophe@unlish.com>
parents: 11555
diff changeset
   124
    activated if `remember()` is called with `persistent=True`:
6398be12f8e6 [doc] Document the new authentication stack
Christophe de Vienne <christophe@unlish.com>
parents: 11555
diff changeset
   125
6398be12f8e6 [doc] Document the new authentication stack
Christophe de Vienne <christophe@unlish.com>
parents: 11555
diff changeset
   126
    .. confval:: cubicweb.auth.authtkt.persistent.cookie_name (str)
6398be12f8e6 [doc] Document the new authentication stack
Christophe de Vienne <christophe@unlish.com>
parents: 11555
diff changeset
   127
6398be12f8e6 [doc] Document the new authentication stack
Christophe de Vienne <christophe@unlish.com>
parents: 11555
diff changeset
   128
        ('auth_tkt') The cookie name. Must be different from the session
6398be12f8e6 [doc] Document the new authentication stack
Christophe de Vienne <christophe@unlish.com>
parents: 11555
diff changeset
   129
        authentication cookie name.
6398be12f8e6 [doc] Document the new authentication stack
Christophe de Vienne <christophe@unlish.com>
parents: 11555
diff changeset
   130
6398be12f8e6 [doc] Document the new authentication stack
Christophe de Vienne <christophe@unlish.com>
parents: 11555
diff changeset
   131
    .. confval:: cubicweb.auth.authtkt.persistent.max_age (int)
6398be12f8e6 [doc] Document the new authentication stack
Christophe de Vienne <christophe@unlish.com>
parents: 11555
diff changeset
   132
6398be12f8e6 [doc] Document the new authentication stack
Christophe de Vienne <christophe@unlish.com>
parents: 11555
diff changeset
   133
        (30 days) Max age in seconds.
6398be12f8e6 [doc] Document the new authentication stack
Christophe de Vienne <christophe@unlish.com>
parents: 11555
diff changeset
   134
6398be12f8e6 [doc] Document the new authentication stack
Christophe de Vienne <christophe@unlish.com>
parents: 11555
diff changeset
   135
    .. confval:: cubicweb.auth.authtkt.persistent.reissue_time (int)
6398be12f8e6 [doc] Document the new authentication stack
Christophe de Vienne <christophe@unlish.com>
parents: 11555
diff changeset
   136
6398be12f8e6 [doc] Document the new authentication stack
Christophe de Vienne <christophe@unlish.com>
parents: 11555
diff changeset
   137
        (1 day) Reissue time in seconds.
6398be12f8e6 [doc] Document the new authentication stack
Christophe de Vienne <christophe@unlish.com>
parents: 11555
diff changeset
   138
6398be12f8e6 [doc] Document the new authentication stack
Christophe de Vienne <christophe@unlish.com>
parents: 11555
diff changeset
   139
.. confval:: cubicweb.auth.groups_principals (bool)
6398be12f8e6 [doc] Document the new authentication stack
Christophe de Vienne <christophe@unlish.com>
parents: 11555
diff changeset
   140
6398be12f8e6 [doc] Document the new authentication stack
Christophe de Vienne <christophe@unlish.com>
parents: 11555
diff changeset
   141
    (True) Setup a callback on the authentication stack that inject the user
6398be12f8e6 [doc] Document the new authentication stack
Christophe de Vienne <christophe@unlish.com>
parents: 11555
diff changeset
   142
    groups in the principals.