Add option to require authentication for read access about devpi

[fschulze]

@chrishas35 I created devpi-lockdown.

[devpi-bot]

Original comment by @hpk42

ASFAIK pip/easy_install only support authentication by specifying username/password encoded into the URL. It's probably not very hard to support that. The idea would be to add ACLs to indexes, i.e. allowing certain users READ, WRITE, or READ/WRITE access. We could then pass auth information to the pip command that "devpi install" generates.

[devpi-bot]

Original comment by pendletongp

Is this feature on the radar?

[devpi-bot]

Original comment by @fschulze

There is experimental support for basic authentication in devpi-client by using a web server like nginx in front of the devpi-server instance. For now those credentials aren't shared with devpi-server though. There are still some issues like https://bitbucket.org/hpk42/devpi/issue/135/basic-auth-doesnt-work-with-https-if-no and https://bitbucket.org/hpk42/devpi/issue/75/use-x-devpi-auth-header-instead-of#comment-11450541

An alternative is the experimental support for client side certificates: https://bitbucket.org/hpk42/devpi/issue/74/add-option-to-devpi-client-to-send-ssl

[devpi-bot]

Original comment by pendletongp

If it is assumed that a server sits in front of devpi, a wsgi authentication module could be used.

For nginx see wsgi_pass_authorization at http://wiki.nginx.org/NgxWSGIModule

For apache see https://docs.djangoproject.com/en/1.7/howto/deployment/wsgi/apache-auth/#authentication-with-mod-wsgi (didn't see this well documented in the apache docs so I linked to the django docs)

It would probably be fairly simple to implement read access for owner only now

[fschulze]

Besides devpi-lockdown we don't intend to add further support for this feature.