Artur Barseghyan: Modern authentication in Python web applications

published May 09, 2014

Artur Barseghyan talks about Modern authentication in Python web applications, at PyGrunn.

See the PyGrunn website for more info about this one-day Python conference in Groningen, The Netherlands.

Part 1: Single Sign-on (SSO) using a Central Authentication Service (CAS).

Without SSO you need to login manually to lots more websites or apps, or put everything in one website/app. Or you can create a custom API to share authentication information.

With SSO a user logs in once and gains access to all systems without begin prompted to log in again.

(JaSig) CAS is an enterprise SSO solution. Open source, well documented. Web browser talks to application server, app server talks to CAS, web browser authenticates with CAS once, CAS gives the app a ticket showing that the web browser is authenticated.

See http://jasig.org/cas

Pro: CAS is modular, highly pluggable, so it is fit for lots of frameworks.

Contra: SSO availability and security become critical. You should subscribe to the CAS mailing list to keep on top of issues. Setup notifications for when your CAS server runs into problems.

Our use case:

  • User base in an Active Directory server
  • CAS server
  • Two apps/websites:
    • Dashboard app in Django
    • Document management system in Plone
    • More to come

CAS alternatives: JOSSO, OpenAM, Pubcookie, CoSign.

Part 2: Two-step verification

Or: two-factor authentication. Can be based on:

  • knowledge factor, something only you know
  • possession factor, something only you possess
  • inheritance factor, something only you have, like fingerprints

Common solutions:

  • SMS authentication. You need to pay for each SMS, so it can become expensive. Phone might not be connected.
  • Google Authenticator (for mobile apps). Very easy to integrate in your app. Requires an extra app to be installed on your device.
  • Hardware token generators. Easy to use. But extra device to carry with you.

Software we made for Plone:

Similar software is available for Django.

Alternatives:

  • risk-based authentication, based on behavioral biometrics, keystroke dynamics, etc
  • strong authentication
  • reliance authentication
Keywords
pygrunn python plone