Package: devpi-tokens
devpi-tokens: authentication tokens plugin for devpiThis plugin adds a authentication tokens todevpi-serverand supporting commands todevpi-client.Installationdevpi-tokensneeds to be installed alongsidedevpi-serverto enable authentication tokens.On client machines the usage of tokens works without the plugin.
The creation of tokens requires thedevpi-tokensplugin to be installed alongsidedevpi-client.
The plugin also adds several commands to inspect and derive tokens with restricted permissions.You can install it with:pip install devpi-tokensThere is no configuration needed asdevpi-serveranddevpi-clientwill automatically discover the plugin through calling hooks using the setuptools entry points mechanism.MotivationThe default authentication mechanism of devpi requires a username and password.
With that the authenticated user has a fixed set of permissions.
Especially for CI systems this is too inflexible.
There is also the risk of leaking the password in log output and other sources.Withdevpi-tokensit is possible to create additional authentication tokens per user.
These tokens can have a limited set of permissions.
It is impossible to modify any user data with a token.It is possible to derive tokens from existing ones and limit the permission set even further without requiring contact with the server.The plugin builds onmacaroons.UsageThedevpi-tokensplugin adds new commands when installed alongsidedevpi-client.WarningBe aware that tokens need to be handled like passwords.
They should always be hidden.
The best way is to store them on the file system with proper permissions and pass them with the-foption to commands liketoken-login.
It is also best practice to limit their usage time with-e/--expires,
so any leaked token can only be used until that time.
Used tokens should also be as limited in scope as possible.token-createCreate a new token for a user.
By default the token is created in the scope of the current user.
Administration users likerootcan create tokens for other users with the-u/--useroption.
The token has a default expiration date of one year,
but that can be changed with the-e/--expiresoption.
With the-a/--allowed,-i/--indexesand-p/--projectsoptions the scope of the token can be further limited.token-deleteDelete an existing token.
Any derived tokens will be invalidated as well.token-deriveTakes an existing token and derives a new one from it.
This allows to limit the scope of the token further than the original one.token-inspectShow information about the given token.
This includes any expiration times and permission limitations etc.token-listShow a list of tokens for a user from the server.
This only shows initial tokens created withtoken-create.
Derived tokens by definition can not be listed,
as they do not require contact to the server.token-loginUse a token for login withdevpi-client.
This is also useful to login longer than the default 10 hours by creating a token with a longer expiration time and no further restrictions.
It is impossible to modify any user data when logged in like this, as tokens never have user manipulation permissions.Changelog1.0.1 - 2023-03-27fix leap year bug1.0.0 - 2023-02-26add Python 3.10 supportdrop Python 3.6 supportaddnot_beforerestrictionsupport restrictions added bypypitokenin devpi-client 6.0.00.6.0 - Unreleasedhide user permissions from help output, as they are disabled on the server
side anywayallow token to be used with basic authentication as username and no password,
or as password with no username0.5.0 - Unreleasedask for confirmation when using unknown permissionsadd option to write generated token to a fileshow list of known devpi-server permissions in helpshow helpful error whendeltadependency is missingfix timezone issue in expiration calculationshow human readable expiration if possible0.4.0 - Unreleasedunify command naming by using prefixaddtoken-deletecommandaddtoken-derivecommandaddtoken-listcommandallowrootor users from--restrict-modifyto create tokens for
other users, and with no expirationadd allowed restriction to tokensadd expiration to tokensadd indexes restriction to tokensadd projects restriction to tokens0.3.0 - Unreleasedaddinspect-tokencommandverify login status when usingtoken-login0.2.0 - Unreleaseduse new hook and derived keys0.1.0 - Unreleased