<HTML><BODY style="word-wrap: break-word; -khtml-nbsp-mode: space; -khtml-line-break: after-white-space; "><BR><DIV><DIV>On Feb 8, 2007, at 7:01 PM, Stephen Waterbury wrote:</DIV><BR class="Apple-interchange-newline"><BLOCKQUOTE type="cite"><DIV>David Reid wrote:</DIV> <BLOCKQUOTE type="cite"><DIV>-----BEGIN PGP SIGNED MESSAGE-----</DIV><DIV>Hash: SHA1</DIV><DIV>On Feb 8, 2007, at 2:51 PM, Stephen Waterbury wrote:</DIV> <BLOCKQUOTE type="cite"><DIV>Jean-Paul Calderone wrote:</DIV> <BLOCKQUOTE type="cite"><DIV>... I think the main problem you're</DIV><DIV>running into is that HTTP digest authentication is being used ...</DIV> </BLOCKQUOTE><DIV><BR></DIV><DIV>*So* (for anybody still listening ;) I finally figured out the</DIV><DIV>implication of Jp's comment: all I had to do was remove the</DIV><DIV>digest.DigestCredentialFactory('md5', 'My Realm') factory</DIV><DIV>instance from HTTPAuthResource's list of credentialFactories</DIV><DIV>and bingo, we're in basic auth mode and my checker works</DIV><DIV>with the web2 auth example -- yay!</DIV> </BLOCKQUOTE><DIV>Why doesn't your DB Checker just support both interfaces? IUsernamePassword, and IUsernameHashedPassword,</DIV><DIV>doing the right thing depending on the interface provided by the credentials input. Or, do the same thing regardless, because they provide compatible checkPassword interfaces. You'd have to read the password from the DB here, but I don't see why that should concern you. And the ability to use Digest auth would provide all around better security.</DIV> </BLOCKQUOTE><DIV><BR></DIV><DIV>Thanks, David, but for my application it isn't useful. IMNSHO, digest</DIV><DIV>auth only gives an illusion of good security -- it's encrypted, right? But I regard it as a waste of time, and the time that I have to work</DIV><DIV>on the actual logic of my application is in short supply as it is.</DIV></BLOCKQUOTE><DIV><BR class="khtml-block-placeholder"></DIV><DIV>Well relative merits of Digest authentication aside, it's trivial to make your DbChecker support the IUsernameHashedPassword of which there are providers other than web2's DigestedCredentials. So I feel like you're really missing out on some of the flexibility that is cred, but you seem to genuinely have no desire (and/or time) for anything more than basic auth so I won't harp on this point anymore.</DIV><DIV><BR class="khtml-block-placeholder"></DIV></DIV>--<BR><DIV> <SPAN class="Apple-style-span" style="border-collapse: separate; border-spacing: 0px 0px; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: auto; -khtml-text-decorations-in-effect: none; text-indent: 0px; -apple-text-size-adjust: auto; text-transform: none; orphans: 2; white-space: normal; widows: 2; word-spacing: 0px; "><SPAN class="Apple-style-span" style="border-collapse: separate; border-spacing: 0px 0px; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: auto; -khtml-text-decorations-in-effect: none; text-indent: 0px; -apple-text-size-adjust: auto; text-transform: none; orphans: 2; white-space: normal; widows: 2; word-spacing: 0px; "><DIV>David Reid</DIV><DIV><A href="http://dreid.org">http://dreid.org</A>/</DIV></SPAN><BR class="Apple-interchange-newline"></SPAN> </DIV><BR></BODY></HTML>