所以我做了什麼是我合併金字塔BasicAuthAuthenticationPolicy和CallbackAuthenticationPolicy和我結束了this。
我已經修改了callback方法使用redis會議
要使用這個類（HTTPAthentication），你可以這樣做（這是一個例子，我如何實現它爲我的用例）：
def _get_userid(details, request):
userre = re.compile("""^([a-zA-Z1-9\.]+):([a-zA-Z1-9\.:-]+)$""", re.I)
userpass = base64.b64decode(details[1])
res = userre.search(userpass)
if res:
return res.group()[0]
def authcheck(username, password, request):
user = Users.by_username(username, enabled=True)
host = request.registry.settings.get("authentication.host", "127.0.0.1")
maxattempts = request.registry.settings.get("authentication.maxattempts",5)
base = _get_userid(request.authorization, request)
if request.redis.exists("pimssess:%s" % base64.b64encode(request.remote_addr+":"+base)):
store = pickle.loads(request.redis.get("pimssess:%s" % base64.b64encode(request.remote_addr+":"+base)))
if store.get("auth.attempts").get(request.remote_addr):
if store["auth.attempts"][request.remote_addr] >= maxattempts:
raise HTTPMethodNotAllowed(body="You have been locked out for 5 minutes")
if user and user.agent and not user.is_http_auth:
raise HTTPMethodNotAllowed(body="You are not permitted http access")
if user and user.agent and user.host != host:
raise HTTPMethodNotAllowed(body="Your host is not permitted http access")
if user and user.agent and not user.validate_password(password):
time.sleep(1.5)
raise HTTPForbidden(body="Failed login, Incorrect password")
return getGroups(username)
getGroups函數重新生成一個連接到用戶的列表groups，即['admin', 'reporting']
我跟着這個例子：BasicAuthAuthenticationPolicy（滾動到底）
以及Web界面登錄（CallbackAuthentication），您創建一個登錄界面，並創建以適應模板中的視圖（檢查用戶名和密碼比賽等）
哦，我差點忘了...在你的項目__init__.py，當你撥打AuthPolicy，在def main(...)。我做了：
authentication = AuthPolicy(secret='@#^&*$!DSYUIDSA8321789DS',
hashalg='sha512', check=authcheck, debug=True)
authorization = ACLAuthorizationPolicy()
config = Configurator(settings=settings, root_factory=RootFactory,
authentication_policy=authentication,
authorization_policy=authorization)
我確實希望這可以幫助某人。