orthauth 0.0.18

Description:

orthauth 0.0.18

orthauth



A library to separate configuration and authentication from program logic
THIS IS NOT ENCRYPTED
THIS IS NOT A PASSWORD MANAGER
THIS IS NOT A SECURE SECRET STORAGE SYSTEM
YOU CAN SHOOT YOURSELF IN THE FOOT WITH THIS
There is NO encryption for secrets stored using orthauth.
Orthauth can source credientials from a variety of sources
but it is INTENTIONALLY INSECURE.
If you do not understand the use case for this as well as the
risks if used outside a secure environment then DO NOT USE IT.
No one can help you if you get pwnd.
Use case
The primary use case for orthauth is to keep api keys from leaking into
source code and winding up in public repositories. orthauth does not provide
operational security for any auth store that it uses. It is up to the user to
secure those and the systems they reside on as they see fit.
While orthauth attemts to prevent secrets from leaking via debug messages
or logging, it doesn't know anything about the secretness of the values it
returns, and once it has returned that value, it is up to the consuming code
to prevent the contents of the value from leaking.
orthauth is indented to unify two common ways managing configuration
variables and credentials: setting them environment variables, and including
them in a plain text file with permissions set to 0600 (and preferably kept
in a folder set to 0700).
For example running a program in the following way
export API_KEY=lolplzdonotstealthis; ./my-script-that-needs-the-key
or using a file like ~/.pgpass or emacs .authinfo. Note that
pgpass probably shouldn't be a source for most python implementations
because libraries like psycopg2 are able to read it directly. However in
other languages that do not have a library that supports reading from pgpass
directly, then pgpass would be a useful source.
By making it possible to provide credentials seemlessley in multiple ways
the hope is to reduce the use of different solutions in different environments
without incuring the massive complexity of maintaining a managed authentication
infrasturcture.
Approach

Decorators
A layer of indirection between names in a code base and config/secrets structure.
Be clear about what should be considered public information. Thus prevent anything
stored as a secret from being used as a key to find another secret.
Bare minimum to store static configuration information, anything more should
be implemented in the language consuming the config, not in the config.

Currently supported config formats



Format
Support
Install




json
builtin
pip install orthauth


python dictionary literals
builtin
pip install orthauth


yaml
requires pyyaml
pip install orthauth[yaml]



Usage
import orthauth as oa
auth = oa.AuthConfig('path/to/config.yaml')

@auth.tangential_init('api_key', 'some-service-api-key')
class ThatNeedsAuth:
""" needs authenticated connection to some-service """

tna = ThatNeedsAuth()
print(tna.api_key)

Haven't been scared off yet?
See the developer guide for more examples.