bluesky-authentication

bluesky-authentication provides shared authenticator implementations and protocol interfaces for Bluesky web services.

It centralizes authentication logic that was previously duplicated across projects, including Tiled and bluesky-httpserver.

Install

Core package:

pip install bluesky-authentication

Optional authenticators require optional dependencies:

• LDAP: pip install "bluesky-authentication[ldap]"
• PAM: pip install "bluesky-authentication[pam]"
• SAML: pip install "bluesky-authentication[saml]"

Basic imports

Import authenticators from bluesky_authentication.authenticators:

from bluesky_authentication.authenticators import (
    DictionaryAuthenticator,
    DummyAuthenticator,
    EntraAuthenticator,
    LDAPAuthenticator,
    OIDCAuthenticator,
    PAMAuthenticator,
    ProxiedOIDCAuthenticator,
    SAMLAuthenticator,
)

Import protocol types from bluesky_authentication.protocols:

from bluesky_authentication.protocols import (
    ExternalAuthenticator,
    InternalAuthenticator,
    UserSessionState,
)

Authenticator usage shape

InternalAuthenticator implementations authenticate username/password:

state = await internal_authenticator.authenticate(username, password)
if state is None:
    # Authentication failed
    ...

ExternalAuthenticator implementations authenticate from a web callback request:

state = await external_authenticator.authenticate(request)
if state is None:
    # Authentication failed
    ...

On success, authenticators return UserSessionState(user_name, state_dict).

Using import paths in service configuration

When wiring authenticators through YAML config, use canonical import paths from this package:

authentication:
  providers:
    - provider: toy
      authenticator: bluesky_authentication.authenticators:DictionaryAuthenticator
      args:
        users_to_passwords:
          alice: ${ALICE_PASSWORD}

The same pattern applies to all built-in authenticators, for example:

• bluesky_authentication.authenticators:PAMAuthenticator
• bluesky_authentication.authenticators:LDAPAuthenticator
• bluesky_authentication.authenticators:OIDCAuthenticator
• bluesky_authentication.authenticators:EntraAuthenticator

Migrating from legacy import paths

Host projects may continue to support legacy paths for backward compatibility, such as tiled.authenticators:* and bluesky_httpserver.authenticators:*.

New configurations should use bluesky_authentication.authenticators:*.