July 30, 2017

Yosai with Darin Gordon

42 minutes

Summary

For any program that is used by more than one person you need a way to control identity and permissions. There are myriad solutions to that problem, but most of them are tied to a specific framework. Yosai is a flexible, general purpose framework for managing role-based access to your applications that has been decoupled from the underlying platform. This week the author of Yosai, Darin Gordon, joins us to talk about why he started it, his experience porting it from Java, and where he hopes to take it in the future.

Preface

Hello and welcome to Podcast.__init__, the podcast about Python and the people who make it great.

I would like to thank everyone who supports us on Patreon. Your contributions help to make the show sustainable.

When you’re ready to launch your next project you’ll need somewhere to deploy it. Check out Linode at www.podastinit.com/linode?utm_source=rss&utm_medium=rss and get a $20 credit to try out their fast and reliable Linux virtual servers for running your awesome app.

Visit the site to subscribe to the show, sign up for the newsletter, read the show notes, and get in touch.

To help other people find the show please leave a review on iTunes, or Google Play Music, tell your friends and co-workers, and share it on social media.

Your host as usual is Tobias Macey and today I’m interviewing

Darin Gordon about Yosai, a security framework for Python applications

Interview

Introductions

How did you get introduced to Python?

What is Yosai and what is the problem that you were trying to solve when you started it?

How does Yosai compare to existing libraries for web frameworks such as Flask-Security or Django Guardian and why might someone choose Yosai instead?

In the documentation it mentions that Yosai is a port of the Apache Shiro framework from Java to Python. What was most difficult about exposing a Pythonic interface while maintaining the core principles of the original?

Authentication and authorization are difficult problem domains and can cause significant issues if they are not implemented in a secure fashion. How do you ensure an appropriate level of quality in Yosai to be confident having people use it?

To start can you describe how the framework is architected and what is involved in integrating it with a project?

Outside of the context of web applications, what are some situations where someone should consider integrating authentication and authorization into their project?

What have been some of the most challenging aspects of building the Yosai project?

Tell us about the Rust extension you wrote earlier this year

What do you have planned for the future of Yosai?

Keep In Touch

Website

GitHub

@darin_gordon on Twitter

Picks

Tobias

Brains On! podcast

Darin

The Asphalt Framework. Asphalt is an asyncio-based microframework for network oriented applications.

Links

Yosai Project Web Page

Github Repo

RBAC

Apache Shiro

TOTP

Pyramid

SOLID

Builder Pattern

POJO

Corey Benfield

Hyper HTTP/2 Library

Passlib

Hugo

MKDocs

YAML

Middleware

IoT

Authz in Rust

PyO3

Snaek

PyCon Canada

PyCascades

JSON Web Tokens

The intro and outro music is from Requiem for a Fish The Freak Fandango Orchestra / CC BY-SA

...more

View all episodes

By Tobias Macey

4.4

100100 ratings