.crossbar 平级目录中添加 authenticator.py 用来操作 crossbar 的认证, 客户端 crossbar 连接输入的用户名密码在这个文件里进行动态认证
from pprint import pprint
from twisted.internet.defer import inlineCallbacks
from autobahn.twisted.wamp import ApplicationSession
from autobahn.wamp.exception import ApplicationError
# crossbar "database"
USERDB = {
'frontend': { # 用户名
'secret': '123456', # 密码
'role': 'frontend' # 角色
},
'backend': {
'authid': 'ID10001',
'secret': '111111',
'role': 'backend'
}
}
class AuthenticatorSession(ApplicationSession):
@inlineCallbacks
def onJoin(self, details):
def authenticate(realm, authid, details):
print("WAMP-CRA dynamic authenticator invoked: realm='{}', authid='{}'".format(realm, authid))
if authid in USERDB:
return USERDB[authid]
else:
raise ApplicationError(u'com.example.no_such_user', 'could not authenticate session - no such user {}'.format(authid))
try:
yield self.register(authenticate, u'com.example.authenticate')
print("WAMP-CRA dynamic authenticator registered!")
except Exception as e:
print("Failed to register dynamic authenticator: {0}".format(e))
修改 .crossbar 文件夹下的 config.json 文件， 默认是 anonymous 配置，再 roles 节点里面修改，添加 authenticator 认证管理 e.g.
...
"realms": [
{
"name": "realm1",
"roles": [
{
"name": "authenticator",
"permissions": [
{
"uri": "com.example.authenticate",
"match": "exact",
"allow": {
"call": false,
"register": true,
"publish": false,
"subscribe": false
},
"disclose": {
"caller": false,
"publisher": false
},
"cache": true
}
]
},
{
"name": "backend",
"permissions": [
{
"uri": "",
"match": "prefix",
"allow": {
"call": true,
"register": true,
"publish": true,
"subscribe": true
},
"disclose": {
"caller": false,
"publisher": false
},
"cache": true
}
]
},
{
"name": "frontend",
"permissions": [
{
"uri": "com.example.add2",
"match": "exact",
"allow": {
"call": true,
"register": false,
"publish": false,
"subscribe": false
},
"disclose": {
"caller": false,
"publisher": false
},
"cache": true
}
]
}
]
}
],
"transports": [
{
"type": "web",
"endpoint": {
"type": "tcp",
"port": 8080
},
"paths": {
"/": {
"type": "static",
"directory": "../web"
},
"ws": {
"type": "websocket",
"auth": {
"wampcra": {
"type": "dynamic",
"authenticator": "com.example.authenticate"
}
}
}
}
}
],
"components": [
{
"type": "class",
"classname": "authenticator.AuthenticatorSession",
"realm": "realm1",
"role": "authenticator"
}
]
...
"name": "backend" 角色为后端，配置权限
"match": "prefix" 设置 uri 的匹配规则。 prefix matching 前缀匹配
{
"name": "backend",
"permissions": [
{
"uri": "",
"match": "prefix",
"allow": {
"call": true,
"register": true,
"publish": true,
"subscribe": true
},
"disclose": {
"caller": false,
"publisher": false
},
"cache": true
}
]
}
设置 websocket 认证方式, auth 中配置 wampcra 模式，类型为 dynamic
"ws": {
"type": "websocket",
"auth": {
"wampcra": {
"type": "dynamic",
"authenticator": "com.example.authenticate"
}
}
}
"name" : "authenticator" 启动crossbar 挂载的 component
"components": [
{
"type": "class",
"classname": "authenticator.AuthenticatorSession",
"realm": "realm1",
"role": "authenticator"
}
]
crossbar 客户端连接添加user和key
backend 角色 python 例子 e.g.
import os
import sys
from twisted.internet import reactor
from twisted.internet.defer import inlineCallbacks
from autobahn.twisted.wamp import ApplicationSession
from autobahn.wamp.types import PublishOptions
from autobahn.wamp import auth
USER = u'backend'
USER_SECRET = u'111111'
class ClientSession(ApplicationSession):
def onConnect(self):
self.join(self.config.realm, [u"wampcra"], USER)
def onChallenge(self, challenge):
if challenge.method == u"wampcra":
if u'salt' in challenge.extra:
key = auth.derive_key(USER_SECRET,
challenge.extra['salt'],
challenge.extra['iterations'],
challenge.extra['keylen'])
else:
key = USER_SECRET
signature = auth.compute_wcs(key, challenge.extra['challenge'])
return signature
else:
raise Exception("Invalid authmethod {}".format(challenge.method))
@inlineCallbacks
def onJoin(self, details):
def add2(x, y):
print("add2() called with {} and {}".format(x, y))
return x + y
try:
reg = yield self.register(add2, u'com.example.add2')
print("procedure add2() registered")
except Exception as e:
print("could not register procedure: {}".format(e))
try:
reg = yield self.register(add2, u'com.example.wewobackend.test')
print("wewobackend.test registered")
except Exception as e:
print("wewobackend.test could not register procedure: {}".format(e))
def onLeave(self, details):
print("Client session left: {}".format(details))
self.disconnect()
def onDisconnect(self):
reactor.stop()
if __name__ == '__main__':
from autobahn.twisted.wamp import ApplicationRunner
runner = ApplicationRunner(url=u'ws://localhost:8080/ws', realm=u'realm1')
runner.run(ClientSession)
