21.1. Visão Geral do Sistema de Autenticação

Fig. 21.1 Anatomia do sistema de autenticação

21.1.1. Banco de Dados de Autenticação

The new authentication system stores authentication configurations in an SQLite database file located, by default, at <profile directory>/qgis-auth.db.

Este banco de dados de autenticação pode ser movido entre as instalações do QGIS sem afetar outras preferências do usuário QGIS atuais, já que é completamente separado das configurações normais do QGIS. Um ID de configuração (uma strig alfanumérica aleatória de 7 caracteres) é gerado ao armazenar inicialmente uma configuração no banco de dados. Isso representa a configuração, permitindo que o ID seja armazenado em componentes de aplicativo de texto simples (como arquivos de projeto, complemento ou configurações) sem a divulgação de suas credenciais associadas.

Nota

O diretório pai do qgis-auth.db pode ser definido usando a seguinte variável de ambiente,``QGIS_AUTH_DB_DIR_PATH``, ou definido na linha de comando durante o lançamento com a opção --authdbdirectory.

21.1.2. Senha mestra

To store or access sensitive information within the database, a user must define a master password. A new master password is requested and verified when initially storing any encrypted data to the database. When sensitive information is accessed, the user is prompted for the master password. The password is then cached for the remainder of the session (until application is quit), unless the user manually chooses an action to clear its cached value. Some instances of using the authentication system do not require input of the master password, such as when selecting an existing authentication configuration, or applying a configuration to a server configuration (such as when adding a WMS layer).

You can choose to save the password in the Wallet/Keyring of your computer.

Fig. 21.2 Insira uma nova senha mestra

Nota

Um caminho para um arquivo contendo a senha mestra pode ser definido usando a seguinte variável de ambiente, QGIS_AUTH_PASSWORD_FILE.

21.1.2.1. Gerenciando a senha mestre

Uma vez definida, a senha mestra pode ser redefinida; a senha mestra atual será necessária antes da redefinição. Durante este processo, existe a opção de gerar um backup completo do banco de dados atual.

Fig. 21.3 Redefinindo a senha mestre

Se o usuário esquecer a senha mestra, não haverá como recuperá-la ou substituí-la. Também não há meio de recuperar informações criptografadas sem saber a senha mestra.

Se um usuário inserir sua senha existente incorretamente três vezes, a caixa de diálogo se oferecerá para apagar o banco de dados.

Fig. 21.4 Solicitação de senha após três tentativas inválidas

21.1.3. Configurações de Autenticação

Você pode gerenciar as configurações de autenticação de Configurações na guia Autenticação da caixa de diálogo Opções do QGIS (Configurações ► Opções).

Fig. 21.5 Configurations editor

Use the button to add a new configuration, the button to remove configurations, and the button to modify existing ones.

Fig. 21.6 Adding config from within Configuration editor

The same type of operations for authentication configuration management (Add, Edit and Remove) can be done when configuring a given service connection, such as configuring an OWS service connection. For that, there are action buttons within the configuration selector for fully managing configurations found within the authentication database. In this case, there is no need to go to the configurations in Authentication tab of QGIS options unless you need to do more comprehensive configuration management.

Fig. 21.7 WMS connection dialog showing Add, Edit, and Remove authentication configuration buttons

When creating or editing an authentication configuration, the info required is a name, an authentication method and any other info that the authentication method requires (see more about the available authentication types in Authentication Methods).

21.1.4. Authentication Methods

Available authentications are provided by C++ plugins much in the same way data provider plugins are supported by QGIS. The method of authentication that can be selected is relative to the access needed for the resource/provider, e.g. HTTP(S) or database, and whether there is support in both QGIS code and a plugin. As such, some authentication method plugins may not be applicable everywhere an authentication configuration selector is shown. A list of available authentication method plugins and their compatible resource/providers can be accessed going to Settings ► Options and, in the Authentication tab, click the Installed Plugins button.

Fig. 21.8 Available method plugins list

Plugins can be created for new authentication methods that do not require QGIS to be recompiled. Since the support for plugins is currently C++-only, QGIS will need to be restarted for the new dropped-in plugin to become available to the user. Ensure your plugin is compiled against the same target version of QGIS if you intend to add it to an existing target install.

Fig. 21.9 Basic HTTP authentication configs

Fig. 21.10 ESRI Token authentication configs

Fig. 21.11 OAuth2 authentication configs

Fig. 21.12 PKI paths authentication configs

Fig. 21.13 PKI PKCS#12 file paths authentication configs

Fig. 21.14 Stored Identity authentication configs

Nota

The Resource URL is currently an unimplemented feature that will eventually allow a particular configuration to be auto-chosen when connecting to resources at a given URL.

21.1.5. Master Password and Auth Config Utilities

Under the Options menu (Settings ► Options) in the Authentication tab, there are several utility actions to manage the authentication database and configurations:

Fig. 21.15 Utilities menu

• Input master password: opens the master password input dialog, independent of performing any authentication database command

• Clear cached master password: unsets the master password if it has been set

• Reset master password: opens a dialog to change the master password (the current password must be known) and optionally back up the current database

• Clear network authentication access cache: clears the authentication cache of all connections

• Automatically clear network authentication access cache on SSL errors: the connection cache stores all authentication data for connections, also when the connection fails. If you change authentication configurations or certification authorities, you should clear the authentication cache or restart QGIS. When this option is checked, the authentication cache will be automatically cleared every time an SSL error occurs and you choose to abort the connection

• Integrate master password with your Wallet/Keyring: adds the master password to your personal Wallet/Keyring

• Store/update the master password in your Wallet/Keyring: updates the changed master password in your Wallet/Keyring

• Clear the master password from your Wallet/Keyring: deletes the master password from your Wallet/Keyring

• Enable password helper debug log: enables a debug tool that will contain all the log information of the authentication methods

• Clear cached authentication configurations: clears the internal lookup cache for configurations, used to speed up network connections. This does not clear QGIS’s core network access manager’s cache, which requires a relaunch of QGIS.

• Remove all authentication configurations: clears the database of all configuration records, without removing other stored records.

• Erase authentication database: schedules a backup of the current database and complete rebuild of the database table structure. The actions are scheduled for a later time, to ensure that other operations, like project loading, do not interrupt the operation or cause errors due to a temporarily missing database.

  

  Fig. 21.16 DB erase verification menu

21.1.6. Using authentication configurations

Typically, an authentication configuration is selected in a configuration dialog for a network services (such as WMS). However, the selector widget can be embedded anywhere authentication is needed or in non-core functionality, like in third-party PyQGIS or C++ plugins.

When using the selector, No authentication is displayed in the pop-up menu control when nothing is selected, when there are no configurations to choose from, or when a previously assigned configuration can no longer be found in the database. The Type and Id fields are read-only and provide a description of the authentication method and the config’s ID respectively.

Fig. 21.17 Authentication configuration selector with no authentication

Fig. 21.18 Authentication configuration selector with selected config

21.1.7. Python bindings

All classes and public functions have sip bindings, except QgsAuthCrypto, since management of the master password hashing and auth database encryption should be handled by the main app, and not via Python. See Security Considerations concerning Python access.