As repoze.what has always seemed a bit over engineered for the needs of TurboGears2 and being it the source of many dependencies and the main blocker to supporting repoze.who 2.X I thought that 2.2 could have been the right time to replace it with something easier to use, document and customize and which wouldn't require 3 external dependencies.
I'm going to try to explain how the new auth layer is going to work so that the community can report any comment before the next 2.2 beta release. First of all the new auth layer is compatible with repoze.what predicates and must be explicitly enabled. This should avoid breaking past projects that customized the authorization layer in any way. Then the new auth layer doesn't replace repoze.who in any way, but only repoze.what. This means that identification, remembering, login and so on is still made by repoze.who and its plugins and projects can continue to declare their own identifiers, challengers and so on. The new authentication layer will be used only if base_config.sa_auth.authmetadata property is set to any value (even None) inside the app_cfg.py (which is the default for newly quickstarted projects). Customizing the new authentication layer should be simpler to understand and faster for simple customizations related to how your application handles groups and permissions as those now rely directly inside your application. For advanced customizations the underlying repoze.who layer is explicitly exposed and any piece of it can be changed directly from base_config.sa_auth options. For anyone interested documentation is available at https://sourceforge.net/p/turbogears2/tg2docs/ci/bd177b9f54babb119fa7066237af1b54818cde13/tree/docs/main/Auth/Customization.rst Please read the new doc and If you find any way in which the new auth layer is worse than the old one let me know it, I'll try to address any issue before 2.2 release! -- You received this message because you are subscribed to the Google Groups "TurboGears Trunk" group. To post to this group, send email to [email protected]. To unsubscribe from this group, send email to [email protected]. For more options, visit this group at http://groups.google.com/group/turbogears-trunk?hl=en.
