On Apr 27, 5:09 pm, Ian Bicking <i...@colorstudy.com> wrote: > On Mon, Apr 27, 2009 at 6:52 PM, Mike Lewis <mikelikes...@gmail.com> wrote: > > Sorry for the confustion. It essentially contains 3 things. > > - An oauth client (uses SA as a store) which could be used outside of > > pylons, repoze, or even wsgi > > - A repoze.who plugin that uses the OAuth client. I used the OpenID > > repoze.who plugin as a starting point since i never wrote one before. > > It's a similar idea. The "user id" ends up being the token they get > > back from twitter > > - repoze.what auth that uses the the repoze.who plugin and an example > > of it protecting a class. > > > I created it to use for a website that uses OAuth for authentication > > from twitter. Even though OAuth is meant for authentication I believe, > > twitter intends it to be used as authentication for other sites as > > well. > > Ah, that explains why it seemed confusing to me ;) I always thought of > persistently associating the authorized request token with the user account, > but I suppose you could just get a new request token each time to do both > kinds of auth at the same time. Huh, interesting. > > -- > Ian Bicking | http://blog.ianbicking.org
Well, I do map it to the userid internally. As far as I'm concerned sine the only authorization I have for my site is whether or not a user is anonymous. I could on the other hand have it use the userid instead of the authorized request token. I actually had it configured that way, but I went back because it's possible to have OAuth with pure authorization for a site (the user could remain completely anonymous aside from their token to the consumer), and in that case I wouldn't have a userid or "specifier" to map it to. It also turns out that Twitter gives the same auth token for the same person every time you authenticate/authorize even though that's not part of the OAuth spec. p.s. My apologies spelling typos/grammar in my last email. Also, I realized probably should have posted this thread to pylons-discuss. --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "pylons-devel" group. To post to this group, send email to pylons-devel@googlegroups.com To unsubscribe from this group, send email to pylons-devel+unsubscr...@googlegroups.com For more options, visit this group at http://groups.google.com/group/pylons-devel?hl=en -~----------~----~----~----~------~----~------~--~---
