repoze.who – WSGI Authentication Middleware

Author:Chris McDonough / Tres Seaver


repoze.who is an identification and authentication framework for arbitrary WSGI applications. It can be used as WSGI middleware, or as an API from within a WSGI application.

repoze.who is inspired by Zope 2’s Pluggable Authentication Service (PAS) (but repoze.who is not dependent on Zope in any way; it is useful for any WSGI application). It provides no facility for authorization (ensuring whether a user can or cannot perform the operation implied by the request). This is considered to be the domain of the WSGI application.

It attempts to reuse implementations from paste.auth for some of its functionality.

Support and Development

To report bugs, use the Repoze bug tracker.

If you’ve got questions that aren’t answered by this documentation, contact the Repoze-dev maillist or join the #repoze IRC channel.

Browse and check out tagged and trunk versions of repoze.who via the Repoze github repository. To check out the trunk via git, use this command:

git clone

Or, if you are logged in:

git clone

To find out how to become a contributor to repoze.who, please see the contributor’s page.

Indices and tables