[Twisted-web] [Nevow] new chapter about authentication

[L. Daniel Burr]

On Fri, 04 Aug 2006 02:16:56 -0500, <glyph at divmod.com> wrote:

> On Thu, 03 Aug 2006 19:58:58 -0500, "L. Daniel Burr"  
> <ldanielburr at mac.com> wrote:
>> On Thu, 03 Aug 2006 17:54:54 -0500, Valentino Volonghi aka Dialtone  
>> <dialtone at divmod.com> wrote:
>> I think this whole discussion is based on a misunderstanding.
>
> I agree.
>

Yay! ;)

>> To me, the bottom line is this: If all you are ever going to do is build
>> web applications, then you will *never* see any real point in jumping
>> through all of cred's hoops (portal, avatar, mind, WTF?
>
> Guard _should_ support single-sign-on systems like OpenID or Active  
> Directory, to minimize the number of passwords that users have to  
> remember when interacting with Twisted sites.
>

I'm sure everyone agrees that SSO support would be highly desirable.

> If it did, it would be a lot easier to sell some of the learning  
> required to use it well.  But I think that we could do a lot to make the  
> learning seem easier: once over the initial hump, guard is not hard to  
> use and the conceptual design is very simple.
>

Absolutely.  The real point I was trying to make is that your "typical"
web developer (yes, I know people hate when I generalize like this) just
wants some mechanism that he/she doesn't have to think about.  Granted,
some people are very uncomfortable using technology that they haven't
read line-for-line, but I'm not one of those.  I actually *like* for
things like authentication/authorization to be black boxes.  Not in
terms of the code, mind you, but in terms of use.  Don't make people
get cred/guard zen in order to feel comfortable using them.

[snip]
> I think that interacting with it through a slightly higher-level
> system like Mantissa is pretty easy, so some focus on a bit of
> boilerplate to hide some of the more advanced details would be good.

Yes, this is the black box to which I was referring.  As someone who
uses Mantissa, one of the things that appealed to me was that I did
not have to do anything but create some user accounts, and I didn't
have to even think about guard.  It all just works, and that's the
kind of ease-of-use that is needed.

Of course, my answer is to just use Mantissa, but there seems to be
a fair number of people who only want Nevow, hence this whole thread.

Thanks for clarifying where cred/guard should go.

L. Daniel Burr (amberite)