n o t e 1 9 . c o m

I’m new to AuthKit, and I wanted to override the method authkit.authenticate.valid_password for the form way of handling authentication. But could not figure out a good way of doing this. It appears that they only way overriding this method is to use the forward handler, but then again I had AuthKit working more or less the way I wanted using the form handler.

So how do you go about overriding one method in a library that you’re using? Well in Python you can use the wraptools module. This allows you to override a method using decorators. For example,

@replaces(authkit.authenticate.valid_password)
def valid_password(environ, username, password):
    try:
        # validate the username/password
        return True
    except YourLoginException:
        return False

If you’re on a hosting environment (e.g., bluehost.com) where the only option to run Python/Pylons is via flup (fast cgi), then you may have experienced this error:


<'exceptions.AssertionError'>: write() argument must be string


The bottom line is that the WSGI spec only supports plain strings.

AuthKit, is a middleware that intercepts HTTP request/response in order to enforce authentication and authorization. One issue that you will encounter is that any page that gets rendered via AuthKit by default will be in unicode. This causes flup to throw the above exception. The fix is pretty straight forward:

def render_signin():
    result = render('/signin.mako')
    result = result.replace('%', '%%').replace('FORM_ACTION', '%s')
    return unicode(result).encode('utf8')

Simply cast the result to unicode and encode it to utf8.

According to Yahoo best e-mail sending practices, it helps if your e-mails have a DKIM signature. On a separate issue, I was having problems with checking e-mail addresses on Yahoo domain (from home on comcast network), so I thought I may as well add a DKIM signature header and see if it improves anything.

Well I did that, and the 1st signed e-mail I sent to my Yahoo e-mail immediately landed in the SPAM folder. So much for signing the e-mail. Anyhow, here are the steps that I needed to complete to add this capability to out-going e-mails from my application. Hopefully over time, the DKIM signing will help with e-mail delivery.

Create a private key:

openssl genrsa -out rsa.private 1024

Create a public key:

openssl rsa -in rsa.private -out rsa.public -pubout -outform PEM

Create A DNS record for your DKIM mail signature, e.g. (base64 public key truncated to display well in the blog)

YOUR-SELECTOR._domainkey.YOUR-DOMAIN IN TXT
"v=DKIM1; p=MIGfMA0GCSqGSIb3DQEBAQUAA4G...; s=email"

Use this wizard to create the TXT record.

You must add this DNS TXT record to your domain DNS entry. Contact your hosting service or your DNS provider. I contacted my hosting company bluehost.com and within an hour the DNS records were updated.

Install the dnspython and pydkim Python modules.

Wait for a while and use dig to check if your DNS record has been updated:

$ dig YOUR-SELECTOR._domainkey.YOUR-DOMAIN TXT

; <<>> DiG 9.6.0-APPLE-P2 <<>> YOUR-SELECTOR._domainkey.YOUR-DOMAIN TXT
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 50920
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;YOUR-SELECTOR._domainkey.YOUR-DOMAIN. IN	TXT

;; ANSWER SECTION:
YOUR_SELECTOR._domainkey.YOUR-DOMAIN. 11678 IN TXT	"v=DKIM1\; p=MIGfMA0GCSqGSIb3DQEBAQUAA4G...; s=email"

;; Query time: 8 msec
;; SERVER: 10.0.1.1#53(10.0.1.1)
;; WHEN: Sun Nov 15 11:26:50 2009
;; MSG SIZE  rcvd: 298

Add the sign/verify option to your e-mail sending program:

    import dkim
    def dkim_sign_message(self, msg):
        try:
            sign = dkim.sign(msg, "YOUR-SELECTOR", "YOUR-DOMAIN", open(self._dkim_private_key, "r").read())
            message = "%s%s" % (sign, msg)

            if not dkim.verify(message):
                print "DKIM verify failed"
                message = msg
            return message
        except Exception as e:
            print "EXCEPTION ... %s" % e
            return msg

Where self._dkim_private_key is the path to the private key file that was created initially.

After you send an e-mail, you can view the e-mail headers from your e-mail client. You should see the Dkim-Signature header. Something like this:

Dkim-Signature: 	v=1; a=rsa-sha256; c=simple/simple; d=aquacue.org; i=@aquacue.org; q=dns/txt; s=accounts; t=1258312155; h=Content-Type : MIME-Version : Subject : From : To : X-Mailer : X-Organization : X-Abuse : X-Sender : X-Originating-IP; bh=JbJO60n6bvNZzyZilOW/hGrD2w5G6cR6o1YHimiwBbU=; b=iy8yt/YQlbhLUt2BpCWmKJ...