Remove support for credentials

Drop experimental support for credentials object: the corresponding
``ClientStorage.__init__`` parameter ``credentials`` is retained but ignored.
From now on ZEO supports authentication only via SSL certificates.

Note that ZEO 5 never supported authenticating via ``username`` and
``password`` - support for such basic auth was dropped in 2016 before ZEO 5.0
was released.

See c7f2138 for details.

Extracted from #195

/reviewed-by @dataflake, @d-maurer
/reviewed-on #220

CHANGES.rst

@@ -8,6 +8,14 @@ Changelog
 
 - Switch to using `async/await` directly instead of `@coroutine/yield`
 
+- Drop experimental support for credentials object: the corresponding
+  ``ClientStorage.__init__`` parameter ``credentials`` is retained but ignored.
+  From now on ZEO supports authentication only via SSL certificates.
+
+  Note that ZEO 5 never supported authenticating via ``username`` and
+  ``password`` - support for such basic auth was dropped in 2016 before ZEO 5.0
+  was released.
+
 
 5.4.0 (2023-01-18)
 ------------------

docs/clients.rst

@@ -280,7 +280,7 @@ authenticate
   parameters in the Python documentation for
   ``ssl.SSLContext.load_verify_locations``.)
 
-  If this setting is used. then certificate authentication is
+  If this setting is used then certificate authentication is
   used to authenticate the server.  The server must be configured
   with one of the certificates supplied using this setting.
 

docs/server.rst

@@ -164,7 +164,7 @@ msgpack
 Server SSL configuration
 ------------------------
 
-A server can optionally support SSL.  Do do so, include a `ssl`
+A server can optionally support SSL.  To do so, include a `ssl`
 subsection of the ZEO section, as in::
 
     <zeo>

src/ZEO/ClientStorage.py

@@ -217,9 +217,6 @@ def __init__(self, addr, storage='1', cache_size=20 * MB,
         wait
             Wait for server connection, defaulting to true.
 
-        credentials
-            [Experimental] Credentials object for authentication to server.
-
         server_sync
             Whether sync() should make a server round trip, thus causing client
             to wait for outstanding invalidations.
@@ -246,6 +243,7 @@ def __init__(self, addr, storage='1', cache_size=20 * MB,
 
             Defaults to false.
 
+        credentials
         username
         password
         realm
@@ -338,7 +336,6 @@ def __init__(self, addr, storage='1', cache_size=20 * MB,
             ZEO.asyncio.client.Fallback if read_only_fallback else read_only,
             wait_timeout or 30,
             ssl=ssl, ssl_server_hostname=ssl_server_hostname,
-            credentials=credentials,
             )
         self._call = self._server.call
         self._async = self._server.async_

src/ZEO/Exceptions.py

@@ -34,11 +34,6 @@ class ClientDisconnected(ClientStorageError,
     """
 
 
-class AuthError(StorageError):
-    """The client provided invalid authentication credentials.
-    """
-
-
 class ProtocolError(ClientStorageError):
     """A client contacted a server with an incomparible protocol
     """

src/ZEO/asyncio/client.py

@@ -68,7 +68,7 @@ class Protocol(base.ZEOBaseProtocol):
     def __init__(self, loop,
                  addr, client, storage_key, read_only, connect_poll=1,
                  heartbeat_interval=60, ssl=None, ssl_server_hostname=None,
-                 credentials=None):
+                 ):
         """Create a server connection
 
         addr is either a host,port tuple or a string file name.
@@ -87,7 +87,6 @@ def __init__(self, loop,
         self.futures = {}  # { message_id -> future }
         self.ssl = ssl
         self.ssl_server_hostname = ssl_server_hostname
-        self.credentials = credentials
         # received invalidations while the protocol is not yet registered with client
         self.invalidations = []
 
@@ -229,23 +228,21 @@ async def verify_connection(self):
         We try to register with the server; if this succeeds with
         the client.
         """
-        credentials = (self.credentials,) if self.credentials else ()
-
         # we do not want that several servers concurrently
         # update the cache -- lock
         async with self.client.register_lock:
             try:
                 try:
                     server_tid = await self.server_call(
                         'register', self.storage_key,
-                        (self.read_only if self.read_only is not Fallback
-                         else False),
-                        *credentials)
+                        self.read_only if self.read_only is not Fallback
+                        else False,
+                        )
                 except ZODB.POSException.ReadOnlyError:
                     if self.read_only is Fallback:
                         self.read_only = True
                         server_tid = await self.server_call(
-                            'register', self.storage_key, True, *credentials)
+                            'register', self.storage_key, True)
                     else:
                         raise
                 else:
@@ -438,7 +435,7 @@ class ClientIO:
     def __init__(self, loop,
                  addrs, client, cache, storage_key, read_only, connect_poll,
                  register_failed_poll=9,
-                 ssl=None, ssl_server_hostname=None, credentials=None):
+                 ssl=None, ssl_server_hostname=None):
         """Create a client interface
 
         *addrs* specifies addresses of a set of servers which
@@ -460,7 +457,6 @@ def __init__(self, loop,
         self.client = client
         self.ssl = ssl
         self.ssl_server_hostname = ssl_server_hostname
-        self.credentials = credentials
         for name in Protocol.client_delegated:
             setattr(self, name, getattr(client, name))
         self.cache = cache
@@ -543,7 +539,6 @@ def try_connecting(self):
                          self.storage_key, self.read_only, self.connect_poll,
                          ssl=self.ssl,
                          ssl_server_hostname=self.ssl_server_hostname,
-                         credentials=self.credentials,
                          )
                 for addr in self.addrs
                 ]
@@ -997,12 +992,11 @@ class ClientThread(ClientRunner):
 
     def __init__(self, addrs, client, cache,
                  storage_key='1', read_only=False, timeout=30,
-                 disconnect_poll=1, ssl=None, ssl_server_hostname=None,
-                 credentials=None):
+                 disconnect_poll=1, ssl=None, ssl_server_hostname=None):
         self.set_options(addrs, client, cache, storage_key, read_only,
                          timeout, disconnect_poll,
                          ssl=ssl, ssl_server_hostname=ssl_server_hostname,
-                         credentials=credentials)
+                         )
         self.thread = threading.Thread(
             target=self.run_io_thread,
             name="%s zeo client networking thread" % client.__name__,

src/ZEO/tests/test_client_credentials.py

@@ -45,10 +45,10 @@ def register(zs, storage_id, read_only, credentials=self):
         client.close()
         creds_log.pop()
 
-        # But if we pass credentials, they'll be passed to register:
+        # Even if we pass credentials, they'll be ignored
         creds = dict(user='me', password='123')
         client = ZEO.client(addr, credentials=creds)
-        self.assertEqual(creds_log, [creds])
+        self.assertEqual(creds_log, [self])
         client.close()
 
         stop()