提交: 41539b93a42eea4574b8020bdaf7f3962eedb53f - allura (git)

allura

Commit MetaInfo

• 修訂: 41539b93a42eea4574b8020bdaf7f3962eedb53f (tree)
• 時間: 2010-05-21 01:35:11
• 作者: Rick Copeland <rcopeland@geek...>
• Commiter: Rick Copeland

Log Message

Plugin refactoring (not Tools)

This commit includes

- Creation of ProjectRegistrationProvider plugins
- Refactoring of AuthenticationProvider and ProjectRegistrationProvider into pyforge.lib.plugin
- Updates to SFX naming convention so /p/foo is registered as 'foo', not 'foo.p'

Change Summary

• modified: pyforge/development.ini
• modified: pyforge/pyforge/controllers/auth.py
• modified: pyforge/pyforge/controllers/root.py
• modified: pyforge/pyforge/controllers/test.py
• modified: pyforge/pyforge/ext/sfx/lib/sfx_api.py
• modified: pyforge/pyforge/ext/sfx/sfx_main.py
• add: pyforge/pyforge/lib/plugin.py
• modified: pyforge/pyforge/model/__init__.py
• modified: pyforge/pyforge/model/auth.py
• modified: pyforge/pyforge/model/project.py
• modified: pyforge/pyforge/model/repository.py
• modified: pyforge/pyforge/tests/model/test_auth.py
• modified: pyforge/setup.py

差異

--- a/pyforge/development.ini
+++ b/pyforge/development.ini
@@ -31,6 +31,8 @@ beaker.session.type = cookie
 beaker.session.secret = 61ece7db-ba8d-49fe-a923-ab444741708c
 beaker.session.validate_key = 714bfe3612c42390726f
 
+registration.method = local
+
 auth.method = local
 auth.ldap.server = ldap://localhost
 auth.ldap.suffix = ou=people,dc=example,dc=com

--- a/pyforge/pyforge/controllers/auth.py
+++ b/pyforge/pyforge/controllers/auth.py
@@ -11,6 +11,7 @@ from pyforge import model as M
 from pyforge.lib.oid_helper import verify_oid, process_oid
 from pyforge.lib.security import require_authenticated
 from pyforge.lib import helpers as h
+from pyforge.lib import plugin
 from pyforge.lib.widgets import SubscriptionForm
 
 log = logging.getLogger(__name__)
@@ -107,7 +108,7 @@ class AuthController(object):
             for open_id in open_ids.split(','):
                 oid = M.OpenId.upsert(open_id, display_name+"'s OpenId")
                 user.claim_openid(open_id)
-        M.AuthenticationProvider.get(request).login(user)
+        plugin.AuthenticationProvider.get(request).login(user)
         flash('User "%s" registered' % user.display_name)
         redirect('/')
 
@@ -170,12 +171,12 @@ class AuthController(object):
 
     @expose()
     def logout(self):
-        M.AuthenticationProvider.get(request).logout()
+        plugin.AuthenticationProvider.get(request).logout()
         redirect('/')
 
     @expose()
     def do_login(self, came_from=None, **kw):
-        user = M.AuthenticationProvider.get(request).login()
+        user = plugin.AuthenticationProvider.get(request).login()
         flash('Welcome back, %s' % user.display_name)
         if came_from and came_from != request.url:
             redirect(came_from)

--- a/pyforge/pyforge/controllers/root.py
+++ b/pyforge/pyforge/controllers/root.py
@@ -15,6 +15,7 @@ import pyforge
 from pyforge.app import SitemapEntry
 from pyforge.lib.base import BaseController
 from pyforge.lib import helpers as h
+from pyforge.lib import plugin
 from pyforge.controllers.error import ErrorController
 from pyforge import model as M
 from pyforge.lib.widgets import project_list as plw
@@ -67,7 +68,7 @@ class RootController(BaseController):
     def _setup_request(self):
         uid = session.get('userid', None)
         c.project = c.app = None
-        c.user = M.AuthenticationProvider.get(request).authenticate_request()
+        c.user = plugin.AuthenticationProvider.get(request).authenticate_request()
         c.queued_messages = []
 
     @expose('pyforge.templates.project_list')

--- a/pyforge/pyforge/controllers/test.py
+++ b/pyforge/pyforge/controllers/test.py
@@ -16,6 +16,7 @@ import pyforge
 from pyforge.lib.base import BaseController
 from pyforge.lib.security import require, require_authenticated, has_project_access, has_artifact_access
 from pyforge.lib import helpers as h
+from pyforge.lib import plugin
 from pyforge import model as M
 from .root import RootController
 from .project import ProjectController
@@ -90,7 +91,7 @@ class TestController(BaseController, ProjectController):
     def __call__(self, environ, start_response):
         c.app = None
         c.project = M.Project.query.get(shortname='test')
-        c.user = M.AuthenticationProvider.get(request).by_username(
+        c.user = plugin.AuthenticationProvider.get(request).by_username(
             environ.get('username', 'test_admin'))
         return BaseController.__call__(self, environ, start_response)
 

--- a/pyforge/pyforge/ext/sfx/lib/sfx_api.py
+++ b/pyforge/pyforge/ext/sfx/lib/sfx_api.py
@@ -59,32 +59,31 @@ class SFXProjectApi(object):
     def _connect(self):
         return closing(httplib.HTTPConnection(self.project_host or request.host))
 
-    def _unix_group_name(self, p):
-        if p.neighborhood.url_prefix != 'p/':
-            path = p.neighborhood.url_prefix + p.shortname
+    def _unix_group_name(self, neighborhood, shortname):
+        if neighborhood.url_prefix != 'p/':
+            path = neighborhood.url_prefix + shortname
         else:
-            path = p.shortname
+            path = shortname
         parts = path.split('/')[1:]
         return '.'.join(reversed(parts))
 
-    def create(self, p):
+    def create(self, neighborhood, shortname, short_description='No description'):
         with self._connect() as conn:
-            ug_name = self._unix_group_name(p)
+            ug_name = self._unix_group_name(neighborhood, shortname)
             args = dict(
                 user_id=c.user.sfx_userid,
                 unix_group_name=ug_name,
-                group_name=p.shortname,
-                short_description=p.short_description)
+                group_name=shortname,
+                short_description=short_description)
             conn.request('POST', self.project_path, json.dumps(args))
             response = conn.getresponse()
             assert response.status == 201, \
                 'Bad status from sfx create: %s' % (response.status)
-            response.read()
-            self.update(p)
+            return response.read()
 
     def read(self, p):
         with self._connect() as conn:
-            ug_name = self._unix_group_name(p)
+            ug_name = self._unix_group_name(p.neighborhood, p.shortname)
             conn.request('GET', self.project_path + '/name/' + ug_name + '/json')
             response = conn.getresponse()
             assert response.status == 200, \
@@ -93,7 +92,7 @@ class SFXProjectApi(object):
 
     def update(self, p):
         with self._connect() as conn:
-            ug_name = self._unix_group_name(p)
+            ug_name = self._unix_group_name(p.neighborhood, p.shortname)
             args = dict(
                 user_id=c.user.sfx_userid,
                 group_name=p.shortname,
@@ -110,7 +109,7 @@ class SFXProjectApi(object):
 
     def delete(self, p):
         with self._connect() as conn:
-            ug_name = self._unix_group_name(p)
+            ug_name = self._unix_group_name(p.neighborhood, p.shortname)
             conn.request('DELETE', self.project_path + '/' + ug_name)
             response = conn.getresponse()
             assert response.status in (200, 404, 410), \

--- a/pyforge/pyforge/ext/sfx/sfx_main.py
+++ b/pyforge/pyforge/ext/sfx/sfx_main.py
@@ -10,6 +10,8 @@ from pyforge import version
 from pyforge.app import Application
 from pyforge.lib.decorators import react
 from pyforge.lib import search
+from pyforge.lib import helpers as h
+from pyforge.lib import plugin
 from pyforge import model as M
 
 from .lib.sfx_api import SFXProjectApi, SFXUserApi
@@ -28,7 +30,7 @@ class SFXApp(Application):
     @react('forge.project_created')
     def project_created(cls, routing_key, doc):
         api = SFXProjectApi()
-        api.create(pylons.c.project)
+        api.update(pylons.c.project)
 
     @classmethod
     @react('forge.project_updated')
@@ -54,7 +56,7 @@ class SFXApp(Application):
     def uninstall(self, project):
         pass # pragma no cover
 
-class SFXAuthenticationProvider(M.AuthenticationProvider):
+class SFXAuthenticationProvider(plugin.AuthenticationProvider):
 
     def __init__(self, request):
         super(SFXAuthenticationProvider, self).__init__(request)
@@ -106,6 +108,24 @@ class SFXAuthenticationProvider(M.AuthenticationProvider):
             with fake_pylons_context(self.request):
                 return api.upsert_user(username, extra)
 
+class SFXProjectRegistrationProvider(plugin.ProjectRegistrationProvider):
+
+    def __init__(self):
+        self.api = SFXUserApi()
+
+    def register_project(self, neighborhood, shortname, user_project):
+        # Reserve project name with SFX
+        r = self.api.create(neighborhood, shortname)
+        log.info('SFX Project creation returned: %s', r)
+        p = super(SFXProjectRegistrationProvider, self).register_project(
+            neighborhood, shortname, user_project)
+        return p
+
+    def register_subproject(self, project, name, install_apps):
+        r = self.api.create(project.neighborhood, project.shortname + '/' + name)
+        log.info('SFX Subproject creation returned: %s', r)
+        return super(SFXProjectRegistrationProvider, self).register_subproject(
+            project, name, install_apps)
 
 @contextmanager
 def fake_pylons_context(request):

--- /dev/null
+++ b/pyforge/pyforge/lib/plugin.py
@@ -0,0 +1,264 @@
+'''
+Pyforge plugins for authentication and project registration
+'''
+import logging
+
+from random import randint
+from hashlib import sha256
+from base64 import b64encode
+from datetime import datetime
+
+import ldap
+import pkg_resources
+from tg import config
+from pylons import g, c
+from webob import exc
+
+from ming.utils import LazyProperty
+from ming.orm import session
+from ming.orm import ThreadLocalORMSession
+
+from pyforge.lib import helpers as h
+
+log = logging.getLogger(__name__)
+
+class AuthenticationProvider(object):
+
+    def __init__(self, request):
+        self.request = request
+
+    @classmethod
+    def get(cls, request):
+        method = config.get('auth.method', 'local')
+        for ep in pkg_resources.iter_entry_points('pyforge.auth', method):
+            return ep.load()(request)
+        return None
+
+    @LazyProperty
+    def session(self):
+        return self.request.environ['beaker.session']
+
+    def authenticate_request(self):
+        from pyforge import model as M
+        return M.User.query.get(_id=self.session.get('userid', None))
+
+    def register_user(self, user_doc):
+        raise NotImplementedError, 'register_user'
+
+    def _login(self):
+        raise NotImplementedError, '_login'
+
+    def login(self, user=None):
+        try:
+            if user is None: user = self._login()
+            self.session['userid'] = user._id
+            self.session.save()
+            return user
+        except exc.HTTPUnauthorized:
+            self.logout()
+            raise
+
+    def logout(self):
+        self.session['userid'] = None
+        self.session.save()
+
+    def by_username(self, username):
+        raise NotImplementedError, 'by_username'
+
+    def set_password(self, user, old_password, new_password):
+        raise NotImplementedError, 'set_password'
+
+class LocalAuthenticationProvider(AuthenticationProvider):
+
+    def register_user(self, user_doc):
+        from pyforge import model as M
+        return M.User(**user_doc)
+
+    def _login(self):
+        user = self.by_username(self.request.params['username'])
+        if not self._validate_password(user, self.request.params['password']):
+            raise exc.HTTPUnauthorized()
+        return user
+
+    def _validate_password(self, user, password):
+        if user is None: return False
+        if not user.password: return False
+        salt = str(user.password[6:6+user.SALT_LEN])
+        check = self._encode_password(password, salt)
+        if check != user.password: return False
+        return True
+
+    def by_username(self, username):
+        from pyforge import model as M
+        return M.User.query.get(username=username)
+
+    def set_password(self, user, old_password, new_password):
+        user.password = self._encode_password(new_password)
+
+    def _encode_password(self, password, salt=None):
+        from pyforge import model as M
+        if salt is None:
+            salt = ''.join(chr(randint(1, 0x7f))
+                           for i in xrange(M.User.SALT_LEN))
+        hashpass = sha256(salt + password.encode('utf-8')).digest()
+        return 'sha256' + salt + b64encode(hashpass)
+
+class LdapAuthenticationProvider(AuthenticationProvider):
+
+    def register_user(self, user_doc):
+        from pyforge import model as M
+        password = user_doc.pop('password', None)
+        result = M.User(**user_doc)
+        dn = 'uid=%s,%s' % (user_doc['username'], config['auth.ldap.suffix'])
+        try:
+            con = ldap.initialize(config['auth.ldap.server'])
+            con.bind_s(config['auth.ldap.admin_dn'],
+                       config['auth.ldap.admin_password'])
+            ldap_info = dict(
+                uid=user_doc['username'],
+                displayName=user_doc['display_name'],
+                cn=user_doc['display_name'],
+                userPassword=password,
+                objectClass=['inetOrgPerson'],
+                givenName=user_doc['display_name'].split()[0],
+                sn=user_doc['display_name'].split()[-1])
+            ldap_info = dict((k,v) for k,v in ldap_info.iteritems()
+                             if v is not None)
+            try:
+                con.add_s(dn, ldap_info.items())
+            except ldap.ALREADY_EXISTS:
+                con.modify_s(dn, [(ldap.MOD_REPLACE, k, v)
+                                  for k,v in ldap_info.iteritems()])
+            con.unbind_s()
+        except:
+            raise
+        return result
+
+    def by_username(self, username):
+        from pyforge import model as M
+        return M.User.query.get(username=username)
+
+    def set_password(self, user, old_password, new_password):
+        try:
+            dn = 'uid=%s,%s' % (self.username, config['auth.ldap.suffix'])
+            con = ldap.initialize(config['auth.ldap.server'])
+            con.bind_s(dn, old_password)
+            con.modify_s(dn, [(ldap.MOD_REPLACE, 'userPassword', new_password)])
+            con.unbind_s()
+        except ldap.INVALID_CREDENTIALS:
+            raise exc.HTTPUnauthorized()
+
+    def _login(self):
+        from pyforge import model as M
+        user = M.User.query.get(username=self.request.params['username'])
+        if user is None: raise exc.HTTPUnauthorized()
+        try:
+            dn = 'uid=%s,%s' % (user.username, config['auth.ldap.suffix'])
+            con = ldap.initialize(config['auth.ldap.server'])
+            con.bind_s(dn, self.request.params['password'])
+            con.unbind_s()
+        except ldap.INVALID_CREDENTIALS:
+            raise exc.HTTPUnauthorized()
+        return user
+
+class ProjectRegistrationProvider(object):
+
+    @classmethod
+    def get(cls):
+        method = config.get('registration.method', 'local')
+        for ep in pkg_resources.iter_entry_points('pyforge.project_registration', method):
+            return ep.load()()
+        return None
+
+    def register_project(self, neighborhood, shortname, user, user_project):
+        '''Register a new project in the neighborhood.  The given user will
+        become the project's superuser.  If no user is specified, c.user is used.
+        '''
+        from pyforge import model as M
+        assert h.re_path_portion.match(shortname.replace('/', '')), \
+            'Invalid project shortname'
+        p = M.Project.query.get(shortname=shortname)
+        if p:
+            assert p.neighborhood == neighborhood, (
+                'Project %s exists in neighborhood %s' % (
+                    shortname, p.neighborhood.name))
+            return p
+        database = 'project:' + shortname.replace('/', ':').replace(' ', '_')
+        p = M.Project(neighborhood_id=neighborhood._id,
+                    shortname=shortname,
+                    name=shortname,
+                    short_description='',
+                    description=(shortname + '\n'
+                                 + '=' * 80 + '\n\n'
+                                 + 'You can edit this description in the admin page'),
+                    database=database,
+                    last_updated = datetime.utcnow(),
+                    is_root=True)
+        try:
+            p.configure_project_database()
+            with h.push_config(c, project=p, user=user):
+                assert M.ProjectRole.query.find().count() == 0, \
+                    'Project roles already exist'
+                # Install default named roles (#78)
+                role_owner = M.ProjectRole(name='Admin')
+                role_developer = M.ProjectRole(name='Developer')
+                role_member = M.ProjectRole(name='Member')
+                role_auth = M.ProjectRole(name='*authenticated')
+                role_anon = M.ProjectRole(name='*anonymous')
+                # Setup subroles
+                role_owner.roles = [ role_developer._id ]
+                role_developer.roles = [ role_member._id ]
+                p.acl['create'] = [ role_owner._id ]
+                p.acl['read'] = [ role_owner._id, role_developer._id, role_member._id,
+                                  role_anon._id ]
+                p.acl['update'] = [ role_owner._id ]
+                p.acl['delete'] = [ role_owner._id ]
+                p.acl['tool'] = [ role_owner._id ]
+                p.acl['security'] = [ role_owner._id ]
+                pr = user.project_role()
+                pr.roles = [ role_owner._id, role_developer._id, role_member._id ]
+                # Setup builtin tool applications
+                if user_project:
+                    p.install_app('profile', 'profile')
+                else:
+                    p.install_app('home', 'home')
+                p.install_app('admin', 'admin')
+                p.install_app('search', 'search')
+                ThreadLocalORMSession.flush_all()
+        except:
+            ThreadLocalORMSession.close_all()
+            log.exception('Error registering project, attempting to drop %s',
+                          database)
+            try:
+                session(p).impl.bind._conn.drop_database(database)
+            except:
+                log.exception('Error dropping database %s', database)
+                pass
+            raise
+        g.publish('react', 'forge.project_created')
+        return p
+
+    def register_subproject(self, project, name, install_apps):
+        from pyforge import model as M
+        assert h.re_path_portion.match(name), 'Invalid subproject shortname'
+        shortname = project.shortname + '/' + name
+        sp = M.Project(
+            parent_id=project._id,
+            neighborhood_id=project.neighborhood_id,
+            shortname=shortname,
+            name=name,
+            database=project.database,
+            last_updated = datetime.utcnow(),
+            is_root=False)
+        with h.push_config(c, project=sp):
+            M.AppConfig.query.remove(dict(project_id=c.project._id))
+            if install_apps:
+                sp.install_app('home', 'home')
+                sp.install_app('admin', 'admin')
+                sp.install_app('search', 'search')
+            g.publish('react', 'forge.project_created')
+        return sp
+
+
+class LocalProjectRegistrationProvider(ProjectRegistrationProvider):
+    pass

--- a/pyforge/pyforge/model/__init__.py
+++ b/pyforge/pyforge/model/__init__.py
@@ -6,7 +6,6 @@ from .project import Theme, Neighborhood, NeighborhoodFile, Project, ProjectCate
 from .discuss import Discussion, Thread, PostHistory, Post, Attachment
 from .artifact import Artifact, Message, VersionedArtifact, Snapshot, ArtifactLink, Feed, AwardFile, Award, AwardGrant
 from .auth import User, ProjectRole, OpenId, EmailAddress, ApiToken
-from .auth import AuthenticationProvider, LocalAuthenticationProvider, LdapAuthenticationProvider
 from .openid_model import OpenIdStore, OpenIdAssociation, OpenIdNonce
 from .filesystem import File
 from .tag import TagEvent, Tag, UserTags

--- a/pyforge/pyforge/model/auth.py
+++ b/pyforge/pyforge/model/auth.py
@@ -4,40 +4,25 @@ import urllib
 import hmac
 import hashlib
 from datetime import timedelta, datetime
-from base64 import b64encode
-from random import randint
 from hashlib import sha256
 
-import ldap
 import iso8601
 import pymongo
-import pkg_resources
 from pylons import c, g, request
-from tg import config
-from webob import exc
 
 from ming import schema as S
-from ming.utils import LazyProperty
 from ming.orm.ormsession import ThreadLocalORMSession
 from ming.orm import session, state, MappedClass
 from ming.orm import FieldProperty, RelationProperty, ForeignIdProperty
 
 from pyforge.lib import helpers as h
+from pyforge.lib import plugin
 from .session import ProjectSession
 from .session import main_doc_session, main_orm_session
 from .session import project_doc_session, project_orm_session
 
 log = logging.getLogger(__name__)
 
-SALT_LENGTH=8
-
-def encode_password(password, salt=None):
-    if salt is None:
-        salt = ''.join(chr(randint(1, 0x7f))
-                       for i in xrange(SALT_LENGTH))
-    hashpass = sha256(salt + password.encode('utf-8')).digest()
-    return 'sha256' + salt + b64encode(hashpass)
-
 class ApiToken(MappedClass):
     class __mongometa__:
         name='api_token'
@@ -180,7 +165,7 @@ class User(MappedClass):
 
     @classmethod
     def by_username(cls, name):
-        return AuthenticationProvider.get(request).by_username(name)
+        return plugin.AuthenticationProvider.get(request).by_username(name)
 
     def address_object(self, addr):
         return EmailAddress.query.get(_id=addr, claimed_by_user_id=self._id)
@@ -204,7 +189,7 @@ class User(MappedClass):
     @classmethod
     def register(cls, doc, make_project=True):
         from pyforge import model as M
-        result = AuthenticationProvider.get(request).register_user(doc)
+        result = plugin.AuthenticationProvider.get(request).register_user(doc)
         if result and make_project:
             n = M.Neighborhood.query.get(name='Users')
             n.register_project('u/' + result.username, result, user_project=True)
@@ -247,7 +232,7 @@ class User(MappedClass):
                 return ProjectRole.query.get(user_id=self._id)
 
     def set_password(self, new_password):
-        return AuthenticationProvider.get(request).set_password(
+        return plugin.AuthenticationProvider.get(request).set_password(
             self, self.password, new_password)
 
     @classmethod
@@ -301,128 +286,3 @@ class ProjectRole(MappedClass):
                 for rr in pr.role_iter(visited):
                     yield rr
 
-class AuthenticationProvider(object):
-
-    def __init__(self, request):
-        self.request = request
-
-    @classmethod
-    def get(cls, request):
-        method = config.get('auth.method', 'local')
-        for ep in pkg_resources.iter_entry_points('pyforge.auth', method):
-            return ep.load()(request)
-        return None
-
-    @LazyProperty
-    def session(self):
-        return self.request.environ['beaker.session']
-
-    def authenticate_request(self):
-        return User.query.get(_id=self.session.get('userid', None))
-
-    def register_user(self, user_doc):
-        raise NotImplementedError, 'register_user'
-
-    def _login(self):
-        raise NotImplementedError, '_login'
-
-    def login(self, user=None):
-        try:
-            if user is None: user = self._login()
-            self.session['userid'] = user._id
-            self.session.save()
-            return user
-        except exc.HTTPUnauthorized:
-            self.logout()
-            raise
-
-    def logout(self):
-        self.session['userid'] = None
-        self.session.save()
-
-    def by_username(self, username):
-        raise NotImplementedError, 'by_username'
-
-    def set_password(self, user, old_password, new_password):
-        raise NotImplementedError, 'set_password'
-
-class LocalAuthenticationProvider(AuthenticationProvider):
-
-    def register_user(self, user_doc):
-        return User(**user_doc)
-
-    def _login(self):
-        user = self.by_username(self.request.params['username'])
-        if not self._validate_password(user, self.request.params['password']):
-            raise exc.HTTPUnauthorized()
-        return user
-
-    def _validate_password(self, user, password):
-        if user is None: return False
-        if not user.password: return False
-        salt = str(user.password[6:6+user.SALT_LEN])
-        check = encode_password(password, salt)
-        if check != user.password: return False
-        return True
-
-    def by_username(self, username):
-        return User.query.get(username=username)
-
-    def set_password(self, user, old_password, new_password):
-        user.password = encode_password(new_password)
-
-class LdapAuthenticationProvider(AuthenticationProvider):
-
-    def register_user(self, user_doc):
-        password = user_doc.pop('password', None)
-        result = User(**user_doc)
-        dn = 'uid=%s,%s' % (user_doc['username'], config['auth.ldap.suffix'])
-        try:
-            con = ldap.initialize(config['auth.ldap.server'])
-            con.bind_s(config['auth.ldap.admin_dn'],
-                       config['auth.ldap.admin_password'])
-            ldap_info = dict(
-                uid=user_doc['username'],
-                displayName=user_doc['display_name'],
-                cn=user_doc['display_name'],
-                userPassword=password,
-                objectClass=['inetOrgPerson'],
-                givenName=user_doc['display_name'].split()[0],
-                sn=user_doc['display_name'].split()[-1])
-            ldap_info = dict((k,v) for k,v in ldap_info.iteritems()
-                             if v is not None)
-            try:
-                con.add_s(dn, ldap_info.items())
-            except ldap.ALREADY_EXISTS:
-                con.modify_s(dn, [(ldap.MOD_REPLACE, k, v)
-                                  for k,v in ldap_info.iteritems()])
-            con.unbind_s()
-        except:
-            raise
-        return result
-
-    def by_username(self, username):
-        return User.query.get(username=username)
-
-    def set_password(self, user, old_password, new_password):
-        try:
-            dn = 'uid=%s,%s' % (self.username, config['auth.ldap.suffix'])
-            con = ldap.initialize(config['auth.ldap.server'])
-            con.bind_s(dn, old_password)
-            con.modify_s(dn, [(ldap.MOD_REPLACE, 'userPassword', new_password)])
-            con.unbind_s()
-        except ldap.INVALID_CREDENTIALS:
-            raise exc.HTTPUnauthorized()
-
-    def _login(self):
-        user = User.query.get(username=self.request.params['username'])
-        if user is None: raise exc.HTTPUnauthorized()
-        try:
-            dn = 'uid=%s,%s' % (user.username, config['auth.ldap.suffix'])
-            con = ldap.initialize(config['auth.ldap.server'])
-            con.bind_s(dn, self.request.params['password'])
-            con.unbind_s()
-        except ldap.INVALID_CREDENTIALS:
-            raise exc.HTTPUnauthorized()
-        return user
-

--- a/pyforge/pyforge/model/project.py
+++ b/pyforge/pyforge/model/project.py
@@ -2,6 +2,7 @@ import logging
 import warnings
 from datetime import datetime, timedelta
 
+from tg import config
 from pylons import c, g, request
 import pkg_resources
 from webob import exc
@@ -14,6 +15,7 @@ from ming.orm.property import FieldProperty, RelationProperty, ForeignIdProperty
 from ming.orm.ormsession import ThreadLocalORMSession
 
 from pyforge.lib import helpers as h
+from pyforge.lib import plugin
 from .session import main_doc_session, main_orm_session
 from .session import project_doc_session, project_orm_session
 
@@ -127,70 +129,8 @@ class Neighborhood(MappedClass):
         '''Register a new project in the neighborhood.  The given user will
         become the project's superuser.  If no user is specified, c.user is used.
         '''
-        assert h.re_path_portion.match(shortname.replace('/', '')), \
-            'Invalid project shortname'
-        from . import auth
-        if user is None: user = c.user
-        p = Project.query.get(shortname=shortname)
-        if p:
-            assert p.neighborhood == self, (
-                'Project %s exists in neighborhood %s' % (
-                    shortname, p.neighborhood.name))
-            return p
-        database = 'project:' + shortname.replace('/', ':').replace(' ', '_')
-        p = Project(neighborhood_id=self._id,
-                    shortname=shortname,
-                    name=shortname,
-                    short_description='',
-                    description=(shortname + '\n'
-                                 + '=' * 80 + '\n\n'
-                                 + 'You can edit this description in the admin page'),
-                    database=database,
-                    last_updated = datetime.utcnow(),
-                    is_root=True)
-        try:
-            p.configure_project_database()
-            with h.push_config(c, project=p, user=user):
-                assert auth.ProjectRole.query.find().count() == 0, \
-                    'Project roles already exist'
-                # Install default named roles (#78)
-                role_owner = auth.ProjectRole(name='Admin')
-                role_developer = auth.ProjectRole(name='Developer')
-                role_member = auth.ProjectRole(name='Member')
-                role_auth = auth.ProjectRole(name='*authenticated')
-                role_anon = auth.ProjectRole(name='*anonymous')
-                # Setup subroles
-                role_owner.roles = [ role_developer._id ]
-                role_developer.roles = [ role_member._id ]
-                p.acl['create'] = [ role_owner._id ]
-                p.acl['read'] = [ role_owner._id, role_developer._id, role_member._id,
-                                  role_anon._id ]
-                p.acl['update'] = [ role_owner._id ]
-                p.acl['delete'] = [ role_owner._id ]
-                p.acl['tool'] = [ role_owner._id ]
-                p.acl['security'] = [ role_owner._id ]
-                pr = user.project_role()
-                pr.roles = [ role_owner._id, role_developer._id, role_member._id ]
-                # Setup builtin tool applications
-                if user_project:
-                    p.install_app('profile', 'profile')
-                else:
-                    p.install_app('home', 'home')
-                p.install_app('admin', 'admin')
-                p.install_app('search', 'search')
-                ThreadLocalORMSession.flush_all()
-        except:
-            ThreadLocalORMSession.close_all()
-            log.exception('Error registering project, attempting to drop %s',
-                          database)
-            try:
-                session(p).impl.bind._conn.drop_database(database)
-            except:
-                log.exception('Error dropping database %s', database)
-                pass
-            raise
-        g.publish('react', 'forge.project_created')
-        return p
+        provider = plugin.ProjectRegistrationProvider.get()
+        return provider.register_project(self, shortname, user or c.user, user_project)
 
     def bind_controller(self, controller):
         from pyforge.controllers.project import NeighborhoodController
@@ -434,24 +374,8 @@ class Project(MappedClass):
                 'options.mount_point':mount_point}).first()
 
     def new_subproject(self, name, install_apps=True):
-        assert h.re_path_portion.match(name), 'Invalid subproject shortname'
-        shortname = self.shortname + '/' + name
-        sp = Project(
-            parent_id=self._id,
-            neighborhood_id=self.neighborhood_id,
-            shortname=shortname,
-            name=name,
-            database=self.database,
-            last_updated = datetime.utcnow(),
-            is_root=False)
-        with h.push_config(c, project=sp):
-            AppConfig.query.remove(dict(project_id=c.project._id))
-            if install_apps:
-                sp.install_app('home', 'home')
-                sp.install_app('admin', 'admin')
-                sp.install_app('search', 'search')
-            g.publish('react', 'forge.project_created')
-        return sp
+        provider = plugin.ProjectRegistrationProvider.get()
+        return provider.register_subproject(self, name, install_apps)
 
     def delete(self):
         # Cascade to subprojects

--- a/pyforge/pyforge/model/repository.py
+++ b/pyforge/pyforge/model/repository.py
@@ -52,7 +52,7 @@ class Repository(Artifact):
         return os.path.join(self.fs_path, self.name)
 
     def scm_host(self):
-        return self.tool + config.get('scm.host_suffix', '.' + pylons.request.host)
+        return self.tool + config.get('scm.host', '.' + pylons.request.host)
 
     @property
     def scm_url_path(self):

--- a/pyforge/pyforge/tests/model/test_auth.py
+++ b/pyforge/pyforge/tests/model/test_auth.py
@@ -12,6 +12,7 @@ from ming.orm.ormsession import ThreadLocalORMSession
 import pyforge.model.auth
 from pyforge.lib.app_globals import Globals
 from pyforge import model as M
+from pyforge.lib import plugin
 from pyforge.tests import helpers
 
 def setUp():
@@ -22,8 +23,9 @@ def setUp():
 @with_setup(setUp)
 def test_password_encoder():
     # Verify salt
-    assert M.auth.encode_password('test_pass') != M.auth.encode_password('test_pass')
-    assert M.auth.encode_password('test_pass', '0000') == M.auth.encode_password('test_pass', '0000')
+    ep = plugin.LocalAuthenticationProvider(Request.blank('/'))._encode_password
+    assert ep('test_pass') != ep('test_pass')
+    assert ep('test_pass', '0000') == ep('test_pass', '0000')
 
 @with_setup(setUp)
 def test_email_address():
@@ -66,9 +68,10 @@ def test_user():
             username='nosetest_user'))
     ThreadLocalORMSession.flush_all()
     assert u.private_project().shortname == 'u/nosetest_user'
-    assert len(list(u.role_iter())) == 3
+    roles = list(u.role_iter())
+    assert len(roles) == 3, roles
     u.set_password('foo')
-    provider = M.LocalAuthenticationProvider(Request.blank('/'))
+    provider = plugin.LocalAuthenticationProvider(Request.blank('/'))
     assert provider._validate_password(u, 'foo')
     assert not provider._validate_password(u, 'foobar')
     u.set_password('foobar')

--- a/pyforge/setup.py
+++ b/pyforge/setup.py
@@ -73,10 +73,14 @@ setup(
     sfx = pyforge.ext.sfx:SFXApp
 
     [pyforge.auth]
-    local = pyforge.model.auth:LocalAuthenticationProvider
-    ldap = pyforge.model.auth.LdapAuthenticationProvider
+    local = pyforge.lib.plugin:LocalAuthenticationProvider
+    ldap = pyforge.lib.plugin:LdapAuthenticationProvider
     sfx = pyforge.ext.sfx:SFXAuthenticationProvider
 
+    [pyforge.project_registration]
+    local = pyforge.lib.plugin:LocalProjectRegistrationProvider
+    sfx = pyforge.ext.sfx:SFXProjectRegistrationProvider
+
     [flyway.migrations]
     pyforge = pyforge.migrations