If you feel this is interesting, I can provide the same for master branch so it can be added.
The only remaining thing do if so would be to have a way to specify a separator, or simply split on space and , and ;... and trim all results. This might work for near 100% of usage.
How it is done
It is needed to get groups from request headers, which is only available to the authenticator, and then cache them like it is done with the auth_ldap.
The way it is done is by:
the authorizer is giving groups, so we need to have groups_provider updated
groups_provider is using the authenticator for groups, so we need to have an authenticator
the authenticator is set in TornadoAuth, and the way it gets the username is not customizable, so I added a way to override it with a new base method get_current_user()
the overrided get_current_user() is caching the groups for the authorizer
The only side effect is the identification is no more IpBasedIdentification, disabling auth by IP.
The idea is to have a groups_header_name with space separated list of groups.
Proposal
I've made a fork for version 1.18.0 I'm currently using. https://github.com/bugy/script-server/compare/1.18.0...momiji:script-server:1.18.0-with-groups?expand=1
If you feel this is interesting, I can provide the same for master branch so it can be added. The only remaining thing do if so would be to have a way to specify a separator, or simply split on space and
,and;... and trim all results. This might work for near 100% of usage.How it is done
It is needed to get groups from request headers, which is only available to the authenticator, and then cache them like it is done with the auth_ldap.
The way it is done is by:
The only side effect is the identification is no more IpBasedIdentification, disabling auth by IP.