Recipe10.3.Authenticating Users by Means of a POP Server

Recipe 10.3. Authenticating Users by Means of a POP Server

Credit: Magnus Lyckå

Problem

You are writing a Python application that must authenticate users. All of the users have accounts on some POP servers, and you'd like to reuse, for your own authentication, the user IDs and passwords that your users have on those servers.

Solution

To log into the application, a user must provide the server, user ID and password for his mail account. We try logging into that POP server with these credentialsif that attempt succeeds, then the user has authenticated successfully. (Of course, we don't peek into the user's mailbox!)

def popauth(popHost, user, passwd):     """ Log in and log out, only to verify user identity.         Raise exception in case of failure.     """     import poplib     try:         pop = poplib.POP3(popHost)     except:         raise RuntimeError("Could not establish connection "                            "to %r for password check" % popHost)     try:         # Log in and perform a small sanity check         pop.user(user)         pop.pass_(passwd)         length, size = pop.stat( )         assert type(length) == type(size) == int         pop.quit( )     except:         raise RuntimeError("Could not verify identity. \n"               "User name %r or password incorrect." % user)         pop.quit( )

Discussion

To use this recipe, the application must store somewhere the list of known users and either the single POP server they all share, or the specific POP server on which each user authenticatesit need not be the same POP server for all users. Either a text file, or a simple table in any kind of database, will do just fine for this purpose.

This solution is neat, but it does have some weaknesses:

Users must trust that any application implementing this authentication system won't abuse their email accounts.
POP passwords are, alas!, sent in plain text over the Internet.
We have to trust that the POP server security isn't compromised.
Logging in might take a few seconds if the POP server is slow.
Logging in won't work if the POP server is down.

However, to offset all of these potential drawbacks is the convenience of applications not having to store any passwords, nor forcing a poor overworked system administrator to administer password changes. It's also quite simple! In short, I wouldn't use this approach for a bank system, but I would have no qualms using it, for example, to give users rights to edit web pages at a somewhat restricted WikiWiki, or similarly low-risk applications.

Recipe10.3.Authenticating Users by Means of a POP Server