7 ms·

OAuth for Python made easy

106 points by llambda 14y ago

manojlds 14y ago
Recently I tried doing cas integration for my django website. A colleague pointed to a Rails gem - install a gem, point to the cas url and, poof, done. For django, I struggled, and struggled. Found a couple of libraries and a number of forks of these spread across github and bitbucket. Got one, but it didn't work. Debugged the code, fixed some stuff in my own fork, and got it working 5 hours later. The world of python seems to have lots of half-baked libraries that are dead or dying. Makes you miss Ruby / Rails.
- dbgrandi 14y ago
  I couldn't agree with this more. In Rails, I'm used to using omniauth, and plugging in any number of provider gems that deal with the subtle differences between how Dropbox and LinkedIn and whatever implement OAuth...and having them all hook into whatever Rack based framework I use (Rails, Sinatra, etc) Rauth is a good start, but without a library that couples it to a full web stack, I'm spending a lot of time hooking it into my flask app and trying to make sure I don't make mistakes managing my session variables, etc. Perhaps I'll start up a rauth-providers repo to catalog this stuff.
NelsonMinar 14y ago
Does it work? I tried to do some OAuth in Python a couple of years back and it was a total disaster; four competing libraries, none of which worked. But that was a long time ago and I don't think this Rauth library even existed when I last looked.
- llambda 14y ago
  Maybe you should try it?
- sandyarmstrong 14y ago
  Yes.
- trtg 14y ago
  Yes it definitely works and does so more easily than any alternative I've tried. I've used it to interface quickly to something like 20 different APIs at this point.
peter_l_downs 14y ago
Just in case anyone is confused, this is a library for client-side OAuth. That said, it's great for quick test scripts — it made my life a lot easier when I was working on a provider implementation. EDIT: Although their README only shows an OAuth1 example, check out https://github.com/litl/rauth/blob/master/examples/github-cli.py https://github.com/litl/rauth/blob/master/examples/github-cl... for an example of using it with an OAuth2 provider.
- IheartApplesDix 14y ago
  So I guess that's the open part.
zalew 14y ago
to be honest I am currently lost on the state of oauth in python, has sth changed since this post http://pydanny.com/the-sorry-state-of-python-oauth-providers.html http://pydanny.com/the-sorry-state-of-python-oauth-providers...? as OP is a client lib, could somebody with practical experience tell me what's the current best library for setting up an oauth provider? bonus question: should I bother with 2.0 or stick to 1.0 (3rd party apps and mobile) http://hueniverse.com/2012/07/oauth-2-0-and-the-road-to-hell/ http://hueniverse.com/2012/07/oauth-2-0-and-the-road-to-hell... ?
- peter_l_downs 14y ago
  Not much has changed. I'm currently working to open source an implementation I worked on that's compliant with the finalized version of the spec. The most up-to-date implementation I've seen in the open is https://github.com/hiidef/oauth2app https://github.com/hiidef/oauth2app, which implements draft 16.
  - zalew 14y ago
    thanks, looks sane.
- marquis 14y ago
  https://github.com/hasgeek/lastuser https://github.com/hasgeek/lastuser was the least painless method in my experience but I never tried any non-lastuser clients with it so I can't comment on library compatibility.
  - zalew 14y ago
    it doesn't have any docs and even from the page I have no idea what it actually does, it doesn't look like an oauth provider (?)
    - marquis 14y ago
      It implements oauth 2.0 draft 16. http://www.slideshare.net/jace/user-management-with-lastuser http://www.slideshare.net/jace/user-management-with-lastuser It's not complicated to break down the UI as you need it.
jrussbowman 14y ago
If you're looking for a more full stack framework in python, tornado has had support for oauth since it's release. It's implementation does rely on the tornado ioloop though, so it's not something you can easily just pull and use elsewhere.
- pekk 14y ago
  This is the underlying problem: OAuth implementations that are coupled to other pieces of technology not strictly related to OAuth. So then we keep reimplementing the same protocol over and over again.
- dtwwtd 14y ago
  It's really easy to use too. I recently extended the base implementation for a service that it didn't support and it took me very little time.
  - jrussbowman 14y ago
    I put some time into it a couple years ago before my 2nd kid was born. I've always wanted to go back and work on making it a bit easier to use. One of the things I'd love to do is get rid of it being so tied to request handlers so you can use it more seamlessly in apps.
    - dtwwtd 14y ago
      Yeah it would be great to be able to make API requests using the helper methods from outside of a request handler. As it is, it isn't that difficult to do it otherwise but it's just more code duplication.
idan 14y ago
I wish the author had contributed to existing efforts (https://github.com/idan/oauthlib https://github.com/idan/oauthlib) instead of rolling yet another OAuth implementation. We set out to build a robust, comprehensive, spec-complete OAuth signing logic library a year ago, and today it delivers what it says on the tin, thanks to a lot of work and a raft of dedicated contributors. We have support for all of the OAuth1 spec, and we're working towards OAuth2. The idea is to have one de-facto reference OAuth implementation for python instead of a few confusingly different choices, because the differences are really hard to spot for anybody who hasn't spent some time cuddling up with the RFC. Doing OAuth signing logic correctly is pretty finicky. Requests is great, and we provide a shim layer for it, but it's silly to reimplement the underlying request signing logic for requests, urllib3 or what-have-you. And what happens when you need a server-side implementation for verifying signatures? It makes more sense to do the tricky logic in a separate, testable library than tying it to one representation of an HTTP request. Having said all this, anybody willing to wade into this mess and write something is my kind of crazy. Respect.
- whalesalad 14y ago
  Look at the examples and docs on the oauthlib library. It's like Java. SkeletonValidator(RequestValidator) ??? This is totally the opposite of pragmatism, and one of the main reasons I've moved away from Python and build most things in Ruby now. After doing Django for 5 years, the nail in the coffin was when I wanted to simply access a users me object from their facebook graph timeline. Riddle me that. In ruby-pragmatism land it's a gem and a line or two of code away, thanks to the awesome Koala library. Kenneth Reitz's recent requests library is the first refreshing and pragmatic python tool I have seen in a long time. This oauth library shares the same friendly and straightforward interface too. The docs and examples are directly clear and directly in front of you. It's simple and pragmatic. The stars on the repo's speak for themselves ... rauth has over 700 stars, whereas oauthlib has considerably less than half of that. I'm not trying to tell you that you suck, because I admire your work quite a lot, but I think these days developers want simple and pragmatic.
  - pekk 14y ago
    This entire complaint would go away with a thin 'for humans' wrapper on top. If you look inside requests and its dependencies you will see some complexities too, they are just hidden from you. But this does not mean that it makes sense to write the low-level stuff in a way that prevents reuse - though that reusability might look abstract - this is the reason we are swimming in OAuth implementations.
denzil_correa 14y ago
Thank You, Thank you! After the state of python-oauth2 this comes as the best oauth library to be used in Python. I however I have one query - how would you handle Oauth three-legged requests? [0] This is important for people who do not necessarily build web apps but collect data from Twitter using Oauth (for a higher API limit). [0] https://dev.twitter.com/docs/auth/3-legged-authorization https://dev.twitter.com/docs/auth/3-legged-authorization
toyg 14y ago
Does rauth work with Python 3?
- llambda 14y ago
  Not yet.
  - cadillac 14y ago
    Basically the main reason for python-social-auth (https://github.com/omab/python-social-auth https://github.com/omab/python-social-auth) to use oauthlib/requests-oauthlib instead of rauth.
    - llambda 14y ago
      We have plans to implement Python 3 support. It's not the highest priority but we want it to happen. I'll probably slate it for v0.6.0. By the way, community participation is more than welcome...there was a pull request that provided support for 3 but unfortunately it wasn't updated to bring it inline with the breaking changes 0.5.0 had to introduce. So, if you have any inclination to hack on a patch that provided Python 3 support I'd be very grateful and could probably even work alongside its development.
nostromo 14y ago
If you'll allow me a shameless plug... My company (dailycred) wraps ten OAuth 1 & 2 providers, as well as email & password and Mozilla Persona in a single OAuth 2 call. (We started this project because even just within OAuth 2, providers break spec left and right and OAuth can be a huge headache, so we manage all of those headaches for our customers.)
- johns 14y ago
  If you're wondering what some of the discrepancies are, I wrote up a bunch here: http://john-sheehan.com/post/41653656681/the-good-and-the-bad-of-oauth-2-0-authorization http://john-sheehan.com/post/41653656681/the-good-and-the-ba...

106 points by llambda 14y ago

Recently I tried doing cas integration for my django website. A colleague pointed to a Rails gem - install a gem, point to the cas url and, poof, done. For django, I struggled, and struggled. Found a couple of libraries and a number of forks of these spread across github and bitbucket. Got one, but it didn't work. Debugged the code, fixed some stuff in my own fork, and got it working 5 hours later. The world of python seems to have lots of half-baked libraries that are dead or dying. Makes you miss Ruby / Rails.

dbgrandi 14y ago
I couldn't agree with this more. In Rails, I'm used to using omniauth, and plugging in any number of provider gems that deal with the subtle differences between how Dropbox and LinkedIn and whatever implement OAuth...and having them all hook into whatever Rack based framework I use (Rails, Sinatra, etc) Rauth is a good start, but without a library that couples it to a full web stack, I'm spending a lot of time hooking it into my flask app and trying to make sure I don't make mistakes managing my session variables, etc. Perhaps I'll start up a rauth-providers repo to catalog this stuff.

NelsonMinar 14y ago

Does it work? I tried to do some OAuth in Python a couple of years back and it was a total disaster; four competing libraries, none of which worked. But that was a long time ago and I don't think this Rauth library even existed when I last looked.

llambda 14y ago
Maybe you should try it?
sandyarmstrong 14y ago
Yes.
trtg 14y ago
Yes it definitely works and does so more easily than any alternative I've tried. I've used it to interface quickly to something like 20 different APIs at this point.

peter_l_downs 14y ago

Just in case anyone is confused, this is a library for client-side OAuth. That said, it's great for quick test scripts — it made my life a lot easier when I was working on a provider implementation. EDIT: Although their README only shows an OAuth1 example, check out https://github.com/litl/rauth/blob/master/examples/github-cli.py https://github.com/litl/rauth/blob/master/examples/github-cl... for an example of using it with an OAuth2 provider.

IheartApplesDix 14y ago
So I guess that's the open part.

zalew 14y ago

to be honest I am currently lost on the state of oauth in python, has sth changed since this post http://pydanny.com/the-sorry-state-of-python-oauth-providers.html http://pydanny.com/the-sorry-state-of-python-oauth-providers...? as OP is a client lib, could somebody with practical experience tell me what's the current best library for setting up an oauth provider? bonus question: should I bother with 2.0 or stick to 1.0 (3rd party apps and mobile) http://hueniverse.com/2012/07/oauth-2-0-and-the-road-to-hell/ http://hueniverse.com/2012/07/oauth-2-0-and-the-road-to-hell... ?

peter_l_downs 14y ago
Not much has changed. I'm currently working to open source an implementation I worked on that's compliant with the finalized version of the spec. The most up-to-date implementation I've seen in the open is https://github.com/hiidef/oauth2app https://github.com/hiidef/oauth2app, which implements draft 16.
- zalew 14y ago
  thanks, looks sane.
marquis 14y ago
https://github.com/hasgeek/lastuser https://github.com/hasgeek/lastuser was the least painless method in my experience but I never tried any non-lastuser clients with it so I can't comment on library compatibility.
- zalew 14y ago
  it doesn't have any docs and even from the page I have no idea what it actually does, it doesn't look like an oauth provider (?)
  - marquis 14y ago
    It implements oauth 2.0 draft 16. http://www.slideshare.net/jace/user-management-with-lastuser http://www.slideshare.net/jace/user-management-with-lastuser It's not complicated to break down the UI as you need it.

jrussbowman 14y ago

If you're looking for a more full stack framework in python, tornado has had support for oauth since it's release. It's implementation does rely on the tornado ioloop though, so it's not something you can easily just pull and use elsewhere.

pekk 14y ago
This is the underlying problem: OAuth implementations that are coupled to other pieces of technology not strictly related to OAuth. So then we keep reimplementing the same protocol over and over again.
dtwwtd 14y ago
It's really easy to use too. I recently extended the base implementation for a service that it didn't support and it took me very little time.
- jrussbowman 14y ago
  I put some time into it a couple years ago before my 2nd kid was born. I've always wanted to go back and work on making it a bit easier to use. One of the things I'd love to do is get rid of it being so tied to request handlers so you can use it more seamlessly in apps.
  - dtwwtd 14y ago
    Yeah it would be great to be able to make API requests using the helper methods from outside of a request handler. As it is, it isn't that difficult to do it otherwise but it's just more code duplication.

idan 14y ago

I wish the author had contributed to existing efforts (https://github.com/idan/oauthlib https://github.com/idan/oauthlib) instead of rolling yet another OAuth implementation. We set out to build a robust, comprehensive, spec-complete OAuth signing logic library a year ago, and today it delivers what it says on the tin, thanks to a lot of work and a raft of dedicated contributors. We have support for all of the OAuth1 spec, and we're working towards OAuth2. The idea is to have one de-facto reference OAuth implementation for python instead of a few confusingly different choices, because the differences are really hard to spot for anybody who hasn't spent some time cuddling up with the RFC. Doing OAuth signing logic correctly is pretty finicky. Requests is great, and we provide a shim layer for it, but it's silly to reimplement the underlying request signing logic for requests, urllib3 or what-have-you. And what happens when you need a server-side implementation for verifying signatures? It makes more sense to do the tricky logic in a separate, testable library than tying it to one representation of an HTTP request. Having said all this, anybody willing to wade into this mess and write something is my kind of crazy. Respect.

whalesalad 14y ago
Look at the examples and docs on the oauthlib library. It's like Java. SkeletonValidator(RequestValidator) ??? This is totally the opposite of pragmatism, and one of the main reasons I've moved away from Python and build most things in Ruby now. After doing Django for 5 years, the nail in the coffin was when I wanted to simply access a users me object from their facebook graph timeline. Riddle me that. In ruby-pragmatism land it's a gem and a line or two of code away, thanks to the awesome Koala library. Kenneth Reitz's recent requests library is the first refreshing and pragmatic python tool I have seen in a long time. This oauth library shares the same friendly and straightforward interface too. The docs and examples are directly clear and directly in front of you. It's simple and pragmatic. The stars on the repo's speak for themselves ... rauth has over 700 stars, whereas oauthlib has considerably less than half of that. I'm not trying to tell you that you suck, because I admire your work quite a lot, but I think these days developers want simple and pragmatic.
- pekk 14y ago
  This entire complaint would go away with a thin 'for humans' wrapper on top. If you look inside requests and its dependencies you will see some complexities too, they are just hidden from you. But this does not mean that it makes sense to write the low-level stuff in a way that prevents reuse - though that reusability might look abstract - this is the reason we are swimming in OAuth implementations.

denzil_correa 14y ago

Thank You, Thank you! After the state of python-oauth2 this comes as the best oauth library to be used in Python. I however I have one query - how would you handle Oauth three-legged requests? [0] This is important for people who do not necessarily build web apps but collect data from Twitter using Oauth (for a higher API limit). [0] https://dev.twitter.com/docs/auth/3-legged-authorization https://dev.twitter.com/docs/auth/3-legged-authorization

toyg 14y ago

Does rauth work with Python 3?

llambda 14y ago
Not yet.
- cadillac 14y ago
  Basically the main reason for python-social-auth (https://github.com/omab/python-social-auth https://github.com/omab/python-social-auth) to use oauthlib/requests-oauthlib instead of rauth.
  - llambda 14y ago
    We have plans to implement Python 3 support. It's not the highest priority but we want it to happen. I'll probably slate it for v0.6.0. By the way, community participation is more than welcome...there was a pull request that provided support for 3 but unfortunately it wasn't updated to bring it inline with the breaking changes 0.5.0 had to introduce. So, if you have any inclination to hack on a patch that provided Python 3 support I'd be very grateful and could probably even work alongside its development.

nostromo 14y ago

If you'll allow me a shameless plug... My company (dailycred) wraps ten OAuth 1 & 2 providers, as well as email & password and Mozilla Persona in a single OAuth 2 call. (We started this project because even just within OAuth 2, providers break spec left and right and OAuth can be a huge headache, so we manage all of those headaches for our customers.)

johns 14y ago
If you're wondering what some of the discrepancies are, I wrote up a bunch here: http://john-sheehan.com/post/41653656681/the-good-and-the-bad-of-oauth-2-0-authorization http://john-sheehan.com/post/41653656681/the-good-and-the-ba...