{"action":"created","issue":{"url":"https://api.github.com/repos/morepath/morepath/issues/305","labels_url":"https://api.github.com/repos/morepath/morepath/issues/305/labels{/name}","comments_url":"https://api.github.com/repos/morepath/morepath/issues/305/comments","events_url":"https://api.github.com/repos/morepath/morepath/issues/305/events","html_url":"https://github.com/morepath/morepath/issues/305","id":66993454,"number":305,"title":"Can't get authentication mechanisms to work at all","user":{"login":"davclark","id":120710,"avatar_url":"https://avatars.githubusercontent.com/u/120710?v=3","gravatar_id":"","url":"https://api.github.com/users/davclark","html_url":"https://github.com/davclark","followers_url":"https://api.github.com/users/davclark/followers","following_url":"https://api.github.com/users/davclark/following{/other_user}","gists_url":"https://api.github.com/users/davclark/gists{/gist_id}","starred_url":"https://api.github.com/users/davclark/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/davclark/subscriptions","organizations_url":"https://api.github.com/users/davclark/orgs","repos_url":"https://api.github.com/users/davclark/repos","events_url":"https://api.github.com/users/davclark/events{/privacy}","received_events_url":"https://api.github.com/users/davclark/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-04-07T21:21:29Z","updated_at":"2015-04-08T12:43:30Z","closed_at":null,"body":"I feel I've tried to follow the docs pretty carefully, [using both more.itsdangerous](https://github.com/davclark/morepath-auth/blob/minimal-nonworking/morepath_auth/main.py) and [the built-in Basic Auth](https://github.com/davclark/morepath-auth/blob/permissions/morepath_auth/main.py).\r\n\r\nBasically, using itsdangerous, while the `remember` function will get called via `@request.after`, and I can see a cookie in the response, I never obtain any identity apart from `NO_IDENTITY`.\r\n\r\nOnce I implement a security policy (even if it's a function that returns True), I'm unable to see pages with permission. I thought maybe something was perhaps confused by the itsdangerous code, but the problem persists even after I switched to Basic Auth. I also tried changing to a 401 code, but my browsers don't ask me for basic auth either... I'm guessing this is disabled on non-SSL connections?\r\n\r\nIn any case, I have vastly exceeded my time budget on figuring this out - I'm trying to implement some stuff to help with a clinical trial, and very much like the design of Morepath. But, if I can't have authentication, I can't use it. So, I hope to get some pointers!\r\n\r\nI don't expect you to debug my code - but the intent is for you to have a minimal non-working example. I'd be happy for a pointer to working code."},"comment":{"url":"https://api.github.com/repos/morepath/morepath/issues/comments/90903081","html_url":"https://github.com/morepath/morepath/issues/305#issuecomment-90903081","issue_url":"https://api.github.com/repos/morepath/morepath/issues/305","id":90903081,"user":{"login":"henri-hulski","id":7619824,"avatar_url":"https://avatars.githubusercontent.com/u/7619824?v=3","gravatar_id":"","url":"https://api.github.com/users/henri-hulski","html_url":"https://github.com/henri-hulski","followers_url":"https://api.github.com/users/henri-hulski/followers","following_url":"https://api.github.com/users/henri-hulski/following{/other_user}","gists_url":"https://api.github.com/users/henri-hulski/gists{/gist_id}","starred_url":"https://api.github.com/users/henri-hulski/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/henri-hulski/subscriptions","organizations_url":"https://api.github.com/users/henri-hulski/orgs","repos_url":"https://api.github.com/users/henri-hulski/repos","events_url":"https://api.github.com/users/henri-hulski/events{/privacy}","received_events_url":"https://api.github.com/users/henri-hulski/received_events","type":"User","site_admin":false},"created_at":"2015-04-08T12:43:29Z","updated_at":"2015-04-08T12:43:29Z","body":"At the moment I have no time to look at this, but maybe you take a look at morepath/tests/test_security.py.  There is a working example for basic auth. \r\nI have implemented the JWT auth which is token driven, so I don't know about cookies. "}}