REST API: Implement a simple way to check user credentials 

Bug #867459 reported by Florian Fuchs
This bug affects 3 people
Affects Status Importance Assigned to Milestone
GNU Mailman
Fix Released
Barry Warsaw

Bug Description

Currently there is no way to check a user's credentials via the REST API. While there were discussions on implementing a middleware "hook" to implement complex authentication logic, there should also be a simple way to check if a given combination of a user's credentials (user name and password) matches the one stored in mailman's internal db.

A good way to do this (as discussed on IRC a while ago) could be to implement a SQL stored procedure-like behavior in the REST API.
Meaning: A client sends a uname/pwd-combination to a specific URL resource and receives a plain True or False (200/403 status codes?) if the combination matches. This way, no password string is sent out via the API.

Things to discuss or consider:

1.) How is the password stored in MMs internal db? (plaintext or hashed? if hashed, which algorithm is used?)
2.) (How) should the pwd be encrypted when sent to the API (depends on 1.)?
3.) Should this API resource be limited to requests from localhost and/or via SSL?

Tags: mailman3
description: updated
Changed in mailman:
milestone: none → 3.0.0b1
Barry Warsaw (barry)
Changed in mailman:
status: New → Confirmed
importance: Undecided → High
assignee: nobody → Barry Warsaw (barry)
Barry Warsaw (barry)
Changed in mailman:
milestone: 3.0.0b1 → postponed
Revision history for this message
Barry Warsaw (barry) wrote :

I'm actually going to close this as Fix Committed. Here's what you can do; if this is insufficient, please reopen this bug (although it may indeed get postponed until after 3.0).

Let's say you're Postorius and someone has just typed their email address and password. You GET this resource:

http://localhost:<email address hidden>

Dig out the `password` attribute in the json. Now, you are armed with the encoded-hashed password of the user, and the cleartext password they typed into the form. You then use this Python code to do the verification:

from flufl.password import verify
if verify(json_password, typed_password):
    # The user successfully logged in.

See for details.

Changed in mailman:
milestone: postponed → 3.0.0b2
status: Confirmed → Fix Committed
status: Fix Committed → Fix Released
Revision history for this message
Barry Warsaw (barry) wrote :

Oops, actually the above has been available for a while now, so it's Fixed Released.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Duplicates of this bug

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.