[Webware-discuss] XMLRPC and authentication

[deelan <de...@in...>]

hi there,

i was trying the XML-RPC servlet feature of webkit. i started
using the demo supplied by the webware documentation [1]:

from WebKit.XMLRPCServlet import XMLRPCServlet

class xmlrpc(XMLRPCServlet):

     def exposedMethods(self):
         return ["multiply", "add", "mylist"]

     def multiply(self, x, y):
         return x*y

     def add(self, x, y):
         return x+y

     def mylist(self):
         return [1,2,3]

i've added "mylist" just o test return of a "complex" type. the code 
runs fine,  but i need to protect such servlet using a simple auth
mechanism... i would go for HTTP basic authentication, since it very
widespread and eventually i will turn into HTTP digest auth when system
will require and higher security level.

BTW it's not clear to me how i can plug auth into such XML-RPC 
architecture, from the docs

Easy to customize XML-RPC Servlet behavior
* Just override call() in a subclass
  * Examples:
   * Suppose you want an authentication token or session ID
     to be the first parameter of every method
   * Rather than add that parameter to every method, just
      write a custom call() method

and so i tried to override call method in my sample but i quickly run
into a nasty ProtocolError exception:

from WebKit.XMLRPCServlet import XMLRPCServlet

class xmlrpc(XMLRPCServlet):

     def call(self, methodName, *args, **keywords):

	# TODO: put auth checks here

         # call supa-method
         XMLRPCServlet.call(self, methodName, *args, **keywords)

     def exposedMethods(self):
         return ["multiply", "add", "mylist"]

     def multiply(self, x, y):
         return x*y

     def add(self, x, y):
         return x+y

     def mylist(self):
         return [1,2,3]

this raises:

test code (run both in pythonwin and straight python shell) is:

import xmlrpclib
servlet = xmlrpclib.Server("http://stong:8080/wk/xmlrpc")
print servlet.multiply('foo',3)
Traceback (most recent call last):
   File "<interactive input>", line 1, in ?
   File "C:\Python\lib\xmlrpclib.py", line 1029, in __call__
     return self.__send(self.__name, args)
   File "C:\Python\lib\xmlrpclib.py", line 1316, in __request
     verbose=self.__verbose
   File "C:\Python\lib\xmlrpclib.py", line 1070, in request
     headers
ProtocolError: <ProtocolError for stong:8080/wk/xmlrpc: 500 Server Error>

which is very strange, it seems that an extraneous method not listed
in exposedMethods() just causes an exception... or maybe i'm missing 
something obvious?

is there somewhere that has already done something similar?

thanks in advance.

[1] <http://webware.sourceforge.net/Papers/Python10.pdf>