Merge lp:~khussein/swift/authn into lp:~hudson-openstack/swift/trunk

[Khaled Hussein]

Implemented the proposed protocol to handle authentication in OpenStack services.

[Mike Barton (redbo)]

> self.response_status = status

self.response_status is storing per-request info in a shared object. That could be wrong under concurrency.

> ''.join(response_itr)
> return [resp.read()]
> response.content_length = sum(map(len, response.app_iter))

Storing many GB of data in RAM is a bad idea.

> usersConfig.readfp(open('/etc/openstack/users.ini'))

You shouldn't re-read and parse the basic auth credentials file on every request. The local imports there are kind of ugly too.

> def validateCreds(self, username, password):

only major pep8 violation I see is those camel caps.

> - 'auth=swift.auth.server:app_factory',
> + #'auth=swift.auth.server:app_factory',
> + 'auth=swift.auth.basicauth:app_factory',

Was leaving it this way a mistake? The basic auth isn't super useful right now, and removing the devauth filter completely breaks our dev and testing environments.

review: Needs Fixing

[gholt (gholt)]

We meant for this to be a work-in-progress; sorry.

[gholt (gholt)]

Oh, and these weren't the droids you were looking for anyhow. Move along; move along.

[Khaled Hussein (khussein)]

The proxy-server config now would be [auth1 devauth papiauth]

[Chuck Thier (cthier)]

Initial comments:

1. There is one unit test failure
2. There are 9 functional test failures
3. There are no unit tests for the new pieces of middleware
4. There are no docs that explain how/when to use the different pieces of middleware
5. Do the saio or multiserver install docs need to change?
6. auth1 is a poor choice for the module name and class name
7. Is anything going to need to change when we move to swauth?
8. PEP8:

cthier@storage1:~/swift/authn$ pep8 -r swift/common/middleware/auth1.py
swift/common/middleware/auth1.py:24:1: E302 expected 2 blank lines, found 1
swift/common/middleware/auth1.py:97:1: W293 blank line contains whitespace
swift/common/middleware/auth1.py:112:75: W291 trailing whitespace
swift/common/middleware/auth1.py:113:76: W291 trailing whitespace
swift/common/middleware/auth1.py:140:1: E302 expected 2 blank lines, found 1

cthier@storage1:~/swift/authn$ pep8 -r swift/common/middleware/papiauth.py
swift/common/middleware/papiauth.py:43:50: W291 trailing whitespace
swift/common/middleware/papiauth.py:63:1: W391 blank line at end of file
cthier@storage1:~/swift/authn$ pep8 -r swift/common/middleware/auth.py

cthier@storage1:~/swift/authn$ pep8 -r swift/common/middleware/devauth.py
swift/common/middleware/devauth.py:40:20: W291 trailing whitespace

review: Needs Fixing

[gholt (gholt)]

As I understood things, the DevAuth that we have always used was not going to change except that it was going to set an additional header instead of just setting REMOTE_USER. All the new auth stuff was going to be new files. What happened with that plan?

[Khaled Hussein (khussein)]

Following the 'public or anonymous access' use case that you've mentioned, we've discussed adding the delegated mode, which is documented in our blueprint. So, this added a couple of new changes to the source code. It also lead us to refactor the code base a little bit so that we separate the two concerns: authentication and authorization into two separate modules.

[lp:~khussein/swift/authn]

160. By Khaled Hussein on 2011-01-12

documentation change

161. By Khaled Hussein on 2011-01-12

merge trunk

Unmerged revisions

161. By Khaled Hussein on 2011-01-12

merge trunk

160. By Khaled Hussein on 2011-01-12

documentation change

159. By Khaled Hussein on 2011-01-11

saio documentation changes

158. By Khaled Hussein on 2011-01-11

PEP8 Stuff :)

157. By Khaled Hussein on 2011-01-11

Refactored and Added unit tests

156. By Khaled Hussein on 2011-01-11

fixing conflicts

155. By Khaled Hussein on 2011-01-11

fixed functional tests

154. By Khaled Hussein on 2011-01-10

setup.py config changes

153. By Khaled Hussein on 2011-01-10

Merged trunk

152. By Khaled Hussein on 2011-01-10

Fixed unit tests

=== modified file '.unittests'
--- .unittests	2010-07-13 03:34:34 +0000
+++ .unittests	2011-01-11 20:54:28 +0000
@@ -1,4 +1,4 @@
 #!/bin/bash
 
-nosetests test/unit --exe --with-coverage --cover-package swift --cover-erase
+nosetests test/unit/ --exe --with-coverage --cover-package swift --cover-erase
 rm -f .coverage
 
=== modified file 'doc/source/development_saio.rst'
--- doc/source/development_saio.rst	2010-12-02 01:08:49 +0000
+++ doc/source/development_saio.rst	2011-01-11 20:54:28 +0000
@@ -240,7 +240,7 @@
 
         [pipeline:main]
         # For DevAuth:
-        pipeline = healthcheck cache auth proxy-server
+        pipeline = healthcheck cache devauthn devauthz papiauth proxy-server
         # For Swauth:
         # pipeline = healthcheck cache swauth proxy-server
         
@@ -249,8 +249,14 @@
         allow_account_management = true
 
         # Only needed for DevAuth
-        [filter:auth]
-        use = egg:swift#auth
+        [filter:devauthn]
+        use = egg:swift#devauthn
+
+        [filter:devauthz]
+        use = egg:swift#devauthz
+
+        [filter:papiauth]
+        use = egg:swift#papiauth
 
         # Only needed for Swauth
         [filter:swauth]
 
=== modified file 'setup.py'
--- setup.py	2011-01-05 15:17:36 +0000
+++ setup.py	2011-01-11 20:54:28 +0000
@@ -1,5 +1,5 @@
 #!/usr/bin/python
-# Copyright (c) 2010-2011 OpenStack, LLC.
+# Copyright (c) 2010 OpenStack, LLC.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -94,7 +94,9 @@
             'auth=swift.auth.server:app_factory',
             ],
         'paste.filter_factory': [
-            'auth=swift.common.middleware.auth:filter_factory',
+            'devauthn=swift.common.middleware.devauthn:filter_factory',
+            'devauthz=swift.common.middleware.devauthz:filter_factory',
+            'papiauth=swift.common.middleware.papiauth:filter_factory',
             'swauth=swift.common.middleware.swauth:filter_factory',
             'healthcheck=swift.common.middleware.healthcheck:filter_factory',
             'memcache=swift.common.middleware.memcache:filter_factory',
 
=== added file 'swift/common/middleware/devauthn.py'
--- swift/common/middleware/devauthn.py	1970-01-01 00:00:00 +0000
+++ swift/common/middleware/devauthn.py	2011-01-11 20:54:28 +0000
@@ -0,0 +1,145 @@
+# Copyright (c) 2010 OpenStack, LLC.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from time import time
+
+from eventlet.timeout import Timeout
+from webob.exc import HTTPUnauthorized
+
+from swift.common.bufferedhttp import http_connect_raw as http_connect
+from swift.common.utils import cache_from_env, TRUE_VALUES
+
+
+class DevAuthN(object):
+    """Auth Middleware that uses the dev auth server."""
+
+    def __init__(self, app, conf):
+        self.app = app
+        self.conf = conf
+        self.reseller_prefix = conf.get('reseller_prefix', 'AUTH').strip()
+        if self.reseller_prefix and self.reseller_prefix[-1] != '_':
+            self.reseller_prefix += '_'
+        self.auth_host = conf.get('ip', '127.0.0.1')
+        self.auth_prefix = conf.get('prefix', '/')
+        self.auth_port = int(conf.get('port', 11000))
+        self.ssl = conf.get('ssl', 'false').lower() in TRUE_VALUES
+        self.timeout = int(conf.get('node_timeout', 10))
+        self.delegated = int(conf.get('delegated', 0))
+
+    def __call__(self, env, start_response):
+        """
+        Accepts a standard WSGI application call and authenticates the request.
+        For an authenticated request, SWIFT_GROUPS will be set to a comma
+        separated list of the user's groups. It'll also set X-Authorization
+        header to 'Proxy [Username]'. If it is running in a delegated mode, it
+        sets the X-Identity-Status header to 'Confirmed' if the token is valid,
+        or 'Indeterminate' if the token doesn't exist.
+
+        With a non-empty reseller prefix, acts as the definitive auth service
+        for just tokens and accounts that begin with that prefix, but will deny
+        requests outside this prefix if no other auth middleware overrides it.
+
+        With an empty reseller prefix, acts as the definitive auth service only
+        for tokens that validate to a non-empty set of groups. For all other
+        requests, acts as the fallback auth service when no other auth
+        middleware overrides it.
+        """
+
+        def custom_start_response(status, headers):
+            if self.delegated:
+                headers.append(('WWW-Authenticate', "Basic realm='API Realm'"))
+            return start_response(status, headers)
+
+        token = env.get('HTTP_X_AUTH_TOKEN', env.get('HTTP_X_STORAGE_TOKEN'))
+        if token and token.startswith(self.reseller_prefix):
+                # Note: Empty reseller_prefix will match all tokens.
+                # Attempt to auth my token with my auth server
+                groups = \
+                    self.get_groups(token, memcache_client=cache_from_env(env))
+                if groups:
+                    user = groups and groups.split(',', 1)[0] or ''
+                    env['SWIFT_GROUPS'] = groups
+                    env['HTTP_X_AUTHORIZATION'] = "Proxy " + user
+                    if self.delegated:
+                        env['HTTP_X_IDENTITY_STATUS'] = "Confirmed"
+                    # We know the proxy logs the token, so we augment it just
+                    # a bit to also log the authenticated user.
+                    env['HTTP_X_AUTH_TOKEN'] = '%s,%s' % (user, token)
+                else:
+                    if self.delegated and not self.reseller_prefix:
+                        env['HTTP_X_IDENTITY_STATUS'] = "Invalid"
+                    else:
+                        # Unauthorized token
+                        return HTTPUnauthorized()(env, custom_start_response)
+        else:
+            env['HTTP_X_AUTHORIZATION'] = "Proxy"
+            if self.delegated:
+                env['HTTP_X_IDENTITY_STATUS'] = "Indeterminate"
+            else:
+                return HTTPUnauthorized()(env, custom_start_response)
+
+        env['HTTP_AUTHORIZATION'] = "Basic dTpw"
+        return self.app(env, custom_start_response)
+
+    def get_groups(self, token, memcache_client=None):
+        """
+        Get groups for the given token.
+
+        If memcache_client is set, token credentials will be cached
+        appropriately.
+
+        With a cache miss, or no memcache_client, the configurated external
+        authentication server will be queried for the group information.
+
+        :param token: Token to validate and return a group string for.
+        :param memcache_client: Memcached client to use for caching token
+                                credentials; None if no caching is desired.
+        :returns: None if the token is invalid or a string containing a comma
+                  separated list of groups the authenticated user is a member
+                  of. The first group in the list is also considered a unique
+                  identifier for that user.
+        """
+        groups = None
+        key = '%s/token/%s' % (self.reseller_prefix, token)
+        cached_auth_data = memcache_client and memcache_client.get(key)
+        if cached_auth_data:
+            start, expiration, groups = cached_auth_data
+            if time() - start > expiration:
+                groups = None
+        if not groups:
+            with Timeout(self.timeout):
+                conn = http_connect(self.auth_host, self.auth_port, 'GET',
+                        '%stoken/%s' % (self.auth_prefix, token), ssl=self.ssl)
+                resp = conn.getresponse()
+                resp.read()
+                conn.close()
+            if resp.status // 100 != 2:
+                return None
+            expiration = float(resp.getheader('x-auth-ttl'))
+            groups = resp.getheader('x-auth-groups')
+            if memcache_client:
+                memcache_client.set(key, (time(), expiration, groups),
+                                    timeout=expiration)
+        return groups
+
+
+def filter_factory(global_conf, **local_conf):
+    """Returns a WSGI filter app for use with paste.deploy."""
+    conf = global_conf.copy()
+    conf.update(local_conf)
+
+    def auth_filter(app):
+        return DevAuthN(app, conf)
+    return auth_filter
 
=== renamed file 'swift/common/middleware/auth.py' => 'swift/common/middleware/devauthz.py'
--- swift/common/middleware/auth.py	2011-01-05 16:14:31 +0000
+++ swift/common/middleware/devauthz.py	2011-01-11 20:54:28 +0000
@@ -13,17 +13,13 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-from time import time
-
-from eventlet.timeout import Timeout
 from webob.exc import HTTPForbidden, HTTPUnauthorized, HTTPNotFound
 
-from swift.common.bufferedhttp import http_connect_raw as http_connect
 from swift.common.middleware.acl import clean_acl, parse_acl, referrer_allowed
-from swift.common.utils import cache_from_env, split_path, TRUE_VALUES
-
-
-class DevAuth(object):
+from swift.common.utils import split_path, TRUE_VALUES
+
+
+class DevAuthZ(object):
     """Auth Middleware that uses the dev auth server."""
 
     def __init__(self, app, conf):
@@ -42,110 +38,50 @@
         """
         Accepts a standard WSGI application call, authenticating the request
         and installing callback hooks for authorization and ACL header
-        validation. For an authenticated request, REMOTE_USER will be set to a
-        comma separated list of the user's groups.
-
-        With a non-empty reseller prefix, acts as the definitive auth service
-        for just tokens and accounts that begin with that prefix, but will deny
-        requests outside this prefix if no other auth middleware overrides it.
-
-        With an empty reseller prefix, acts as the definitive auth service only
-        for tokens that validate to a non-empty set of groups. For all other
-        requests, acts as the fallback auth service when no other auth
-        middleware overrides it.
+        validation.
         """
-        token = env.get('HTTP_X_AUTH_TOKEN', env.get('HTTP_X_STORAGE_TOKEN'))
-        if token and token.startswith(self.reseller_prefix):
-            # Note: Empty reseller_prefix will match all tokens.
-            # Attempt to auth my token with my auth server
-            groups = \
-                self.get_groups(token, memcache_client=cache_from_env(env))
-            if groups:
-                env['REMOTE_USER'] = groups
-                user = groups and groups.split(',', 1)[0] or ''
-                # We know the proxy logs the token, so we augment it just a bit
-                # to also log the authenticated user.
-                env['HTTP_X_AUTH_TOKEN'] = '%s,%s' % (user, token)
+        groups = None
+        if 'SWIFT_GROUPS' in env:
+            groups = env['SWIFT_GROUPS']
+            env['REMOTE_USER'] = groups
+            self.authorize = self.dev_authorize
+            env['swift.clean_acl'] = clean_acl
+        elif 'swift.authorize' not in env:
+            self.authorize = self.empty_authorize
+
+        if self.reseller_prefix:
+            # With a non-empty reseller_prefix, I would like to be called
+            # back for anonymous access to accounts I know I'm the
+            # definitive auth for.
+            try:
+                version, rest = split_path(env.get('PATH_INFO', ''),
+                                           1, 2, True)
+            except ValueError:
+                return HTTPNotFound()(env, start_response)
+            if rest and rest.startswith(self.reseller_prefix):
+                # Handle anonymous access to accounts I'm the definitive
+                # auth for.
                 env['swift.authorize'] = self.authorize
                 env['swift.clean_acl'] = clean_acl
-            else:
-                # Unauthorized token
-                if self.reseller_prefix:
-                    # Because I know I'm the definitive auth for this token, I
-                    # can deny it outright.
-                    return HTTPUnauthorized()(env, start_response)
-                # Because I'm not certain if I'm the definitive auth for empty
-                # reseller_prefixed tokens, I won't overwrite swift.authorize.
-                elif 'swift.authorize' not in env:
-                    env['swift.authorize'] = self.denied_response
-        else:
-            if self.reseller_prefix:
-                # With a non-empty reseller_prefix, I would like to be called
-                # back for anonymous access to accounts I know I'm the
-                # definitive auth for.
-                try:
-                    version, rest = split_path(env.get('PATH_INFO', ''),
-                                               1, 2, True)
-                except ValueError:
-                    return HTTPNotFound()(env, start_response)
-                if rest and rest.startswith(self.reseller_prefix):
-                    # Handle anonymous access to accounts I'm the definitive
-                    # auth for.
-                    env['swift.authorize'] = self.authorize
-                    env['swift.clean_acl'] = clean_acl
-                # Not my token, not my account, I can't authorize this request,
-                # deny all is a good idea if not already set...
-                elif 'swift.authorize' not in env:
-                    env['swift.authorize'] = self.denied_response
-            # Because I'm not certain if I'm the definitive auth for empty
-            # reseller_prefixed accounts, I won't overwrite swift.authorize.
+            # Not my token, not my account, I can't authorize this request,
+            # deny all is a good idea if not already set...
             elif 'swift.authorize' not in env:
-                env['swift.authorize'] = self.authorize
-                env['swift.clean_acl'] = clean_acl
+                env['swift.authorize'] = self.denied_response
+        # Because I'm not certain if I'm the definitive auth for empty
+        # reseller_prefixed accounts, I won't overwrite swift.authorize.
+        elif 'swift.authorize' not in env:
+            env['swift.authorize'] = self.empty_authorize
         return self.app(env, start_response)
 
-    def get_groups(self, token, memcache_client=None):
-        """
-        Get groups for the given token.
-
-        If memcache_client is set, token credentials will be cached
-        appropriately.
-
-        With a cache miss, or no memcache_client, the configurated external
-        authentication server will be queried for the group information.
-
-        :param token: Token to validate and return a group string for.
-        :param memcache_client: Memcached client to use for caching token
-                                credentials; None if no caching is desired.
-        :returns: None if the token is invalid or a string containing a comma
-                  separated list of groups the authenticated user is a member
-                  of. The first group in the list is also considered a unique
-                  identifier for that user.
-        """
-        groups = None
-        key = '%s/token/%s' % (self.reseller_prefix, token)
-        cached_auth_data = memcache_client and memcache_client.get(key)
-        if cached_auth_data:
-            start, expiration, groups = cached_auth_data
-            if time() - start > expiration:
-                groups = None
-        if not groups:
-            with Timeout(self.timeout):
-                conn = http_connect(self.auth_host, self.auth_port, 'GET',
-                        '%stoken/%s' % (self.auth_prefix, token), ssl=self.ssl)
-                resp = conn.getresponse()
-                resp.read()
-                conn.close()
-            if resp.status // 100 != 2:
-                return None
-            expiration = float(resp.getheader('x-auth-ttl'))
-            groups = resp.getheader('x-auth-groups')
-            if memcache_client:
-                memcache_client.set(key, (time(), expiration, groups),
-                                    timeout=expiration)
-        return groups
-
-    def authorize(self, req):
+    def empty_authorize(self, req):
+        if 'x_identity_status' in req.headers:
+            if req.headers['x_identity_status'] == 'Invalid':
+                return self.denied_response(req)
+            elif req.headers['x_identity_status'] == 'Indeterminate':
+                return self.dev_authorize(req)
+        return None
+
+    def dev_authorize(self, req):
         """
         Returns None if the request is authorized to continue or a standard
         WSGI response callable if not.
@@ -179,10 +115,13 @@
         Returns a standard WSGI response callable with the status of 403 or 401
         depending on whether the REMOTE_USER is set or not.
         """
+        headers = [('www-authenticate', 'delegated')]
         if req.remote_user:
-            return HTTPForbidden(request=req)
+            resp = HTTPForbidden(headers=headers, request=req)
         else:
-            return HTTPUnauthorized(request=req)
+            resp = HTTPUnauthorized(headers=headers, request=req)
+
+        return resp
 
 
 def filter_factory(global_conf, **local_conf):
@@ -191,5 +130,5 @@
     conf.update(local_conf)
 
     def auth_filter(app):
-        return DevAuth(app, conf)
+        return DevAuthZ(app, conf)
     return auth_filter
 
=== added file 'swift/common/middleware/papiauth.py'
--- swift/common/middleware/papiauth.py	1970-01-01 00:00:00 +0000
+++ swift/common/middleware/papiauth.py	2011-01-11 20:54:28 +0000
@@ -0,0 +1,62 @@
+# Copyright (c) 2010 OpenStack, LLC.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from webob.exc import HTTPUseProxy, HTTPUnauthorized
+
+from swift.common.utils import TRUE_VALUES
+
+
+class PAPIAuth(object):
+    """Auth Middleware that uses the dev auth server."""
+
+    def __init__(self, app, conf):
+        self.app = app
+        self.conf = conf
+        self.reseller_prefix = conf.get('reseller_prefix', 'AUTH').strip()
+        if self.reseller_prefix and self.reseller_prefix[-1] != '_':
+            self.reseller_prefix += '_'
+        self.auth_host = conf.get('ip', '127.0.0.1')
+        self.auth_port = int(conf.get('port', 11000))
+        self.auth_pass = conf.get('pass', 'dTpw')
+        self.ssl = conf.get('ssl', 'false').lower() in TRUE_VALUES
+        self.timeout = int(conf.get('node_timeout', 10))
+
+    def __call__(self, env, start_response):
+        # Make sure that the user has been authenticated by the Auth Service
+        if 'HTTP_X_AUTHORIZATION' not in env:
+            proxy_location = 'http://' + self.auth_host + ':' + \
+                str(self.auth_port) + '/'
+            return HTTPUseProxy(location=proxy_location)(env, start_response)
+
+        # Authenticate the Auth component itself.
+        headers = [('www-authenticate', 'Basic realm="swift"')]
+        if 'HTTP_AUTHORIZATION' not in env:
+            return HTTPUnauthorized(headers=headers)(env, start_response)
+        else:
+            auth_type, encoded_creds = env['HTTP_AUTHORIZATION'].split(None, 1)
+            if encoded_creds != self.auth_pass:
+                return HTTPUnauthorized(headers=headers)(env, start_response)
+
+        return self.app(env, start_response)
+
+
+def filter_factory(global_conf, **local_conf):
+    """Returns a WSGI filter app for use with paste.deploy."""
+    conf = global_conf.copy()
+    conf.update(local_conf)
+
+    def auth_filter(app):
+        return PAPIAuth(app, conf)
+    return auth_filter
 
=== modified file 'test/unit/common/middleware/test_auth.py'
--- test/unit/common/middleware/test_auth.py	2011-01-05 16:14:31 +0000
+++ test/unit/common/middleware/test_auth.py	2011-01-11 20:54:28 +0000
@@ -23,7 +23,7 @@
 import eventlet
 from webob import Request
 
-from swift.common.middleware import auth
+from swift.common.middleware import devauthn, devauthz, papiauth
 
 # mocks
 logging.getLogger().addHandler(logging.StreamHandler(sys.stdout))
@@ -122,243 +122,281 @@
 class TestAuth(unittest.TestCase):
 
     def setUp(self):
-        self.test_auth = auth.filter_factory({})(FakeApp())
+        self.test_authn = devauthn.filter_factory({})(FakeApp())
+        self.test_authz = devauthz.filter_factory({})(FakeApp())
+        self.test_papiauth = papiauth.filter_factory({})(FakeApp())
 
     def test_auth_deny_non_reseller_prefix(self):
-        old_http_connect = auth.http_connect
-        try:
-            auth.http_connect = mock_http_connect(204,
-               {'x-auth-ttl': '1234', 'x-auth-groups': 'act:usr,act,AUTH_cfa'})
-            reqenv = {'REQUEST_METHOD': 'GET', 'PATH_INFO': '/v1/BLAH_account',
-                'HTTP_X_AUTH_TOKEN': 'BLAH_t', 'swift.cache': FakeMemcache()}
-            result = ''.join(self.test_auth(reqenv, lambda x, y: None))
-            self.assert_(result.startswith('401'), result)
-            self.assertEquals(reqenv['swift.authorize'],
-                              self.test_auth.denied_response)
-        finally:
-            auth.http_connect = old_http_connect
+        reqenv = {'REQUEST_METHOD': 'GET', 'PATH_INFO': '/v1/BLAH_account',
+            'HTTP_X_AUTH_TOKEN': 'BLAH_t', 'swift.cache': FakeMemcache()}
+        result = ''.join(self.test_authz(reqenv, lambda x, y: None))
+        self.assert_(result.startswith('401'), result)
+        self.assertEquals(reqenv['swift.authorize'],
+                          self.test_authz.denied_response)
 
     def test_auth_deny_non_reseller_prefix_no_override(self):
-        old_http_connect = auth.http_connect
+        old_http_connect = devauthn.http_connect
         try:
-            auth.http_connect = mock_http_connect(204,
+            local_app = FakeApp()
+            local_authz = \
+                devauthz.filter_factory({'reseller_prefix': ''})(local_app)
+            local_authn = \
+                devauthn.filter_factory({'delegated': 1})(local_authz)
+            devauthn.http_connect = mock_http_connect(204,
                {'x-auth-ttl': '1234', 'x-auth-groups': 'act:usr,act,AUTH_cfa'})
             fake_authorize = lambda x: lambda x, y: ['500 Fake']
             reqenv = {'REQUEST_METHOD': 'GET', 'PATH_INFO': '/v1/BLAH_account',
                 'HTTP_X_AUTH_TOKEN': 'BLAH_t', 'swift.cache': FakeMemcache(),
                 'swift.authorize': fake_authorize}
-            result = ''.join(self.test_auth(reqenv, lambda x, y: None))
+            result = ''.join(local_authn(reqenv, lambda x, y: None))
             self.assert_(result.startswith('500 Fake'), result)
             self.assertEquals(reqenv['swift.authorize'], fake_authorize)
         finally:
-            auth.http_connect = old_http_connect
+            devauthn.http_connect = old_http_connect
 
-    def test_auth_no_reseller_prefix_deny(self):
+    def test_auth_no_reseller_prefix_deny_delegated(self):
         # Ensures that when we have no reseller prefix, we don't deny a request
         # outright but set up a denial swift.authorize and pass the request on
         # down the chain.
-        old_http_connect = auth.http_connect
+        old_http_connect = devauthn.http_connect
         try:
             local_app = FakeApp()
-            local_auth = \
-                auth.filter_factory({'reseller_prefix': ''})(local_app)
-            auth.http_connect = mock_http_connect(404)
+            local_authz = \
+                devauthz.filter_factory({'reseller_prefix': ''})(local_app)
+            local_authn = \
+                devauthn.filter_factory(\
+                    {'reseller_prefix': '', 'delegated': 1})(local_authz)
+            devauthn.http_connect = mock_http_connect(404)
             reqenv = {'REQUEST_METHOD': 'GET', 'PATH_INFO': '/v1/account',
                 'HTTP_X_AUTH_TOKEN': 't', 'swift.cache': FakeMemcache()}
-            result = ''.join(local_auth(reqenv, lambda x, y: None))
+            result = ''.join(local_authn(reqenv, lambda x, y: None))
             self.assert_(result.startswith('401'), result)
             self.assert_(local_app.i_was_called)
             self.assertEquals(reqenv['swift.authorize'],
-                              local_auth.denied_response)
-        finally:
-            auth.http_connect = old_http_connect
+                              local_authz.empty_authorize)
+        finally:
+            devauthn.http_connect = old_http_connect
+
+    def test_auth_no_reseller_prefix_deny_non_delegated(self):
+        # Ensures that when we have no reseller prefix, we don't deny a request
+        # outright but set up a denial swift.authorize and pass the request on
+        # down the chain.
+        old_http_connect = devauthn.http_connect
+        try:
+            local_app = FakeApp()
+            local_authn = \
+                devauthn.filter_factory(\
+                    {'reseller_prefix': ''})(local_app)
+            devauthn.http_connect = mock_http_connect(404)
+            reqenv = {'REQUEST_METHOD': 'GET', 'PATH_INFO': '/v1/account',
+                'HTTP_X_AUTH_TOKEN': 't', 'swift.cache': FakeMemcache()}
+            result = ''.join(local_authn(reqenv, lambda x, y: None))
+            self.assert_(result.startswith('401'), result)
+            self.assert_(not local_app.i_was_called)
+        finally:
+            devauthn.http_connect = old_http_connect
+
 
     def test_auth_no_reseller_prefix_allow(self):
         # Ensures that when we have no reseller prefix, we can still allow
         # access if our auth server accepts requests
-        old_http_connect = auth.http_connect
-        try:
-            local_app = FakeApp()
-            local_auth = \
-                auth.filter_factory({'reseller_prefix': ''})(local_app)
-            auth.http_connect = mock_http_connect(204,
-               {'x-auth-ttl': '1234', 'x-auth-groups': 'act:usr,act,AUTH_cfa'})
-            reqenv = {'REQUEST_METHOD': 'GET', 'PATH_INFO': '/v1/act',
-                'HTTP_X_AUTH_TOKEN': 't', 'swift.cache': None}
-            result = ''.join(local_auth(reqenv, lambda x, y: None))
-            self.assert_(result.startswith('204'), result)
-            self.assert_(local_app.i_was_called)
-            self.assertEquals(reqenv['swift.authorize'],
-                              local_auth.authorize)
-        finally:
-            auth.http_connect = old_http_connect
+        local_app = FakeApp()
+        local_auth = \
+            devauthz.filter_factory({'reseller_prefix': ''})(local_app)
+        reqenv = {'REQUEST_METHOD': 'GET', 'PATH_INFO': '/v1/act',
+            'HTTP_X_AUTH_TOKEN': 't', 'swift.cache': None, 
+            'SWIFT_GROUPS': 'act:usr,act,AUTH_cfa'}
+        result = ''.join(local_auth(reqenv, lambda x, y: None))
+        self.assert_(result.startswith('204'), result)
+        self.assert_(local_app.i_was_called)
+        self.assertEquals(reqenv['swift.authorize'],
+                          local_auth.empty_authorize)
 
-    def test_auth_no_reseller_prefix_no_token(self):
+    def test_auth_no_reseller_prefix_no_token_delegated(self):
         # Check that normally we set up a call back to our authorize.
-        local_auth = \
-            auth.filter_factory({'reseller_prefix': ''})(FakeApp())
+        local_authz = \
+            devauthz.filter_factory({'reseller_prefix': ''})(FakeApp())
+        local_authn = \
+            devauthn.filter_factory(\
+                {'reseller_prefix': '', 'delegated':1})(local_authz)
         reqenv = {'REQUEST_METHOD': 'GET', 'PATH_INFO': '/v1/account',
                   'swift.cache': FakeMemcache()}
-        result = ''.join(local_auth(reqenv, lambda x, y: None))
+        result = ''.join(local_authn(reqenv, lambda x, y: None))
         self.assert_(result.startswith('401'), result)
-        self.assertEquals(reqenv['swift.authorize'], local_auth.authorize)
+        self.assertEquals(\
+            reqenv['swift.authorize'], local_authz.empty_authorize)
         # Now make sure we don't override an existing swift.authorize when we
         # have no reseller prefix.
         local_authorize = lambda req: None
         reqenv['swift.authorize'] = local_authorize
-        result = ''.join(local_auth(reqenv, lambda x, y: None))
+        result = ''.join(local_authz(reqenv, lambda x, y: None))
         self.assert_(result.startswith('204'), result)
         self.assertEquals(reqenv['swift.authorize'], local_authorize)
 
+    def test_auth_no_reseller_prefix_no_token_non_delegated(self):
+        # Ensure that in a non_delegated mode, no token gets denied 
+        # right away.
+        local_app = FakeApp()
+        local_authn = \
+            devauthn.filter_factory(\
+                {'reseller_prefix': ''})(local_app)
+        reqenv = {'REQUEST_METHOD': 'GET', 'PATH_INFO': '/v1/account',
+                  'swift.cache': FakeMemcache()}
+        result = ''.join(local_authn(reqenv, lambda x, y: None))
+        self.assert_(result.startswith('401'), result)
+        self.assert_(not local_app.i_was_called)
+
     def test_auth_fail(self):
-        old_http_connect = auth.http_connect
+        old_http_connect = devauthn.http_connect
         try:
-            auth.http_connect = mock_http_connect(404)
-            result = ''.join(self.test_auth({'REQUEST_METHOD': 'GET',
+            devauthn.http_connect = mock_http_connect(404)
+            result = ''.join(self.test_authn({'REQUEST_METHOD': 'GET',
                 'HTTP_X_AUTH_TOKEN': 'AUTH_t', 'swift.cache': FakeMemcache()},
                 lambda x, y: None))
             self.assert_(result.startswith('401'), result)
         finally:
-            auth.http_connect = old_http_connect
+            devauthn.http_connect = old_http_connect
 
     def test_auth_success(self):
-        old_http_connect = auth.http_connect
+        old_http_connect = devauthn.http_connect
         try:
-            auth.http_connect = mock_http_connect(204,
+            devauthn.http_connect = mock_http_connect(204,
                {'x-auth-ttl': '1234', 'x-auth-groups': 'act:usr,act,AUTH_cfa'})
-            result = ''.join(self.test_auth({'REQUEST_METHOD': 'GET',
+            result = ''.join(self.test_authn({'REQUEST_METHOD': 'GET',
                 'PATH_INFO': '/v/AUTH_cfa', 'HTTP_X_AUTH_TOKEN': 'AUTH_t',
                 'swift.cache': FakeMemcache()}, lambda x, y: None))
             self.assert_(result.startswith('204'), result)
         finally:
-            auth.http_connect = old_http_connect
+            devauthn.http_connect = old_http_connect
 
     def test_auth_memcache(self):
-        old_http_connect = auth.http_connect
+        old_http_connect = devauthn.http_connect
         try:
             fake_memcache = FakeMemcache()
-            auth.http_connect = mock_http_connect(204,
+            devauthn.http_connect = mock_http_connect(204,
                {'x-auth-ttl': '1234', 'x-auth-groups': 'act:usr,act,AUTH_cfa'})
-            result = ''.join(self.test_auth({'REQUEST_METHOD': 'GET',
+            result = ''.join(self.test_authn({'REQUEST_METHOD': 'GET',
                 'PATH_INFO': '/v/AUTH_cfa', 'HTTP_X_AUTH_TOKEN': 'AUTH_t',
                 'swift.cache': fake_memcache}, lambda x, y: None))
             self.assert_(result.startswith('204'), result)
-            auth.http_connect = mock_http_connect(404)
+            devauthn.http_connect = mock_http_connect(404)
             # Should still be in memcache
-            result = ''.join(self.test_auth({'REQUEST_METHOD': 'GET',
+            result = ''.join(self.test_authn({'REQUEST_METHOD': 'GET',
                 'PATH_INFO': '/v/AUTH_cfa', 'HTTP_X_AUTH_TOKEN': 'AUTH_t',
                 'swift.cache': fake_memcache}, lambda x, y: None))
             self.assert_(result.startswith('204'), result)
         finally:
-            auth.http_connect = old_http_connect
+            devauthn.http_connect = old_http_connect
 
     def test_auth_just_expired(self):
-        old_http_connect = auth.http_connect
+        old_http_connect = devauthn.http_connect
         try:
             fake_memcache = FakeMemcache()
-            auth.http_connect = mock_http_connect(204,
+            devauthn.http_connect = mock_http_connect(204,
                 {'x-auth-ttl': '0', 'x-auth-groups': 'act:usr,act,AUTH_cfa'})
-            result = ''.join(self.test_auth({'REQUEST_METHOD': 'GET',
+            result = ''.join(self.test_authn({'REQUEST_METHOD': 'GET',
                 'PATH_INFO': '/v/AUTH_cfa', 'HTTP_X_AUTH_TOKEN': 'AUTH_t',
                 'swift.cache': fake_memcache}, lambda x, y: None))
             self.assert_(result.startswith('204'), result)
-            auth.http_connect = mock_http_connect(404)
+            devauthn.http_connect = mock_http_connect(404)
             # Should still be in memcache, but expired
-            result = ''.join(self.test_auth({'REQUEST_METHOD': 'GET',
+            result = ''.join(self.test_authn({'REQUEST_METHOD': 'GET',
                 'HTTP_X_AUTH_TOKEN': 'AUTH_t', 'swift.cache': fake_memcache},
                 lambda x, y: None))
             self.assert_(result.startswith('401'), result)
         finally:
-            auth.http_connect = old_http_connect
+            devauthn.http_connect = old_http_connect
 
     def test_middleware_success(self):
-        old_http_connect = auth.http_connect
+        old_http_connect = devauthn.http_connect
         try:
-            auth.http_connect = mock_http_connect(204,
+            devauthn.http_connect = mock_http_connect(204,
                {'x-auth-ttl': '1234', 'x-auth-groups': 'act:usr,act,AUTH_cfa'})
             req = Request.blank('/v/AUTH_cfa/c/o',
                                 headers={'x-auth-token': 'AUTH_t'})
             req.environ['swift.cache'] = FakeMemcache()
-            result = ''.join(self.test_auth(req.environ, start_response))
+            result = ''.join(self.test_authn(req.environ, start_response))
             self.assert_(result.startswith('204'), result)
-            self.assertEquals(req.remote_user, 'act:usr,act,AUTH_cfa')
+            self.assertEquals(\
+                req.environ['SWIFT_GROUPS'], 'act:usr,act,AUTH_cfa')
         finally:
-            auth.http_connect = old_http_connect
+            devauthn.http_connect = old_http_connect
 
     def test_middleware_no_header(self):
-        old_http_connect = auth.http_connect
+        old_http_connect = devauthn.http_connect
         try:
-            auth.http_connect = mock_http_connect(204,
+            devauthn.http_connect = mock_http_connect(204,
                {'x-auth-ttl': '1234', 'x-auth-groups': 'act:usr,act,AUTH_cfa'})
             req = Request.blank('/v/AUTH_cfa/c/o')
             req.environ['swift.cache'] = FakeMemcache()
-            result = ''.join(self.test_auth(req.environ, start_response))
+            result = ''.join(self.test_authn(req.environ, start_response))
             self.assert_(result.startswith('401'), result)
             self.assert_(not req.remote_user, req.remote_user)
         finally:
-            auth.http_connect = old_http_connect
+            devauthn.http_connect = old_http_connect
 
     def test_middleware_storage_token(self):
-        old_http_connect = auth.http_connect
+        old_http_connect = devauthn.http_connect
         try:
-            auth.http_connect = mock_http_connect(204,
+            devauthn.http_connect = mock_http_connect(204,
                {'x-auth-ttl': '1234', 'x-auth-groups': 'act:usr,act,AUTH_cfa'})
             req = Request.blank('/v/AUTH_cfa/c/o',
                                 headers={'x-storage-token': 'AUTH_t'})
             req.environ['swift.cache'] = FakeMemcache()
-            result = ''.join(self.test_auth(req.environ, start_response))
+            result = ''.join(self.test_authn(req.environ, start_response))
             self.assert_(result.startswith('204'), result)
-            self.assertEquals(req.remote_user, 'act:usr,act,AUTH_cfa')
+            self.assertEquals(\
+                req.environ['SWIFT_GROUPS'], 'act:usr,act,AUTH_cfa')
         finally:
-            auth.http_connect = old_http_connect
+            devauthn.http_connect = old_http_connect
 
     def test_authorize_bad_path(self):
         req = Request.blank('/badpath')
-        resp = self.test_auth.authorize(req)
+        resp = self.test_authz.dev_authorize(req)
         self.assertEquals(resp and resp.status_int, 401)
         req = Request.blank('/badpath')
         req.remote_user = 'act:usr,act,AUTH_cfa'
-        resp = self.test_auth.authorize(req)
+        resp = self.test_authz.dev_authorize(req)
         self.assertEquals(resp and resp.status_int, 403)
         req = Request.blank('')
-        resp = self.test_auth.authorize(req)
+        resp = self.test_authz.dev_authorize(req)
         self.assertEquals(resp and resp.status_int, 404)
         req = Request.blank('')
         req.environ['swift.cache'] = FakeMemcache()
-        result = ''.join(self.test_auth(req.environ, lambda x, y: None))
+        result = ''.join(self.test_authz(req.environ, lambda x, y: None))
         self.assert_(result.startswith('404'), result)
 
     def test_authorize_account_access(self):
         req = Request.blank('/v1/AUTH_cfa')
         req.remote_user = 'act:usr,act,AUTH_cfa'
-        self.assertEquals(self.test_auth.authorize(req), None)
+        self.assertEquals(self.test_authz.dev_authorize(req), None)
         req = Request.blank('/v1/AUTH_cfa')
         req.remote_user = 'act:usr,act'
-        resp = self.test_auth.authorize(req)
+        resp = self.test_authz.dev_authorize(req)
         self.assertEquals(resp and resp.status_int, 403)
 
     def test_authorize_acl_group_access(self):
         req = Request.blank('/v1/AUTH_cfa')
         req.remote_user = 'act:usr,act'
-        resp = self.test_auth.authorize(req)
+        resp = self.test_authz.dev_authorize(req)
         self.assertEquals(resp and resp.status_int, 403)
         req = Request.blank('/v1/AUTH_cfa')
         req.remote_user = 'act:usr,act'
         req.acl = 'act'
-        self.assertEquals(self.test_auth.authorize(req), None)
+        self.assertEquals(self.test_authz.dev_authorize(req), None)
         req = Request.blank('/v1/AUTH_cfa')
         req.remote_user = 'act:usr,act'
         req.acl = 'act:usr'
-        self.assertEquals(self.test_auth.authorize(req), None)
+        self.assertEquals(self.test_authz.dev_authorize(req), None)
         req = Request.blank('/v1/AUTH_cfa')
         req.remote_user = 'act:usr,act'
         req.acl = 'act2'
-        resp = self.test_auth.authorize(req)
+        resp = self.test_authz.dev_authorize(req)
         self.assertEquals(resp and resp.status_int, 403)
         req = Request.blank('/v1/AUTH_cfa')
         req.remote_user = 'act:usr,act'
         req.acl = 'act:usr2'
-        resp = self.test_auth.authorize(req)
+        resp = self.test_authz.dev_authorize(req)
         self.assertEquals(resp and resp.status_int, 403)
 
     def test_deny_cross_reseller(self):
@@ -366,96 +404,96 @@
         req = Request.blank('/v1/OTHER_cfa')
         req.remote_user = 'act:usr,act,AUTH_cfa'
         req.acl = 'act'
-        resp = self.test_auth.authorize(req)
+        resp = self.test_authz.dev_authorize(req)
         self.assertEquals(resp and resp.status_int, 403)
 
     def test_authorize_acl_referrer_access(self):
         req = Request.blank('/v1/AUTH_cfa')
         req.remote_user = 'act:usr,act'
-        resp = self.test_auth.authorize(req)
-        self.assertEquals(resp and resp.status_int, 403)
-        req = Request.blank('/v1/AUTH_cfa')
-        req.remote_user = 'act:usr,act'
-        req.acl = '.r:*'
-        self.assertEquals(self.test_auth.authorize(req), None)
-        req = Request.blank('/v1/AUTH_cfa')
-        req.remote_user = 'act:usr,act'
-        req.acl = '.r:.example.com'
-        resp = self.test_auth.authorize(req)
-        self.assertEquals(resp and resp.status_int, 403)
-        req = Request.blank('/v1/AUTH_cfa')
-        req.remote_user = 'act:usr,act'
-        req.referer = 'http://www.example.com/index.html'
-        req.acl = '.r:.example.com'
-        self.assertEquals(self.test_auth.authorize(req), None)
-        req = Request.blank('/v1/AUTH_cfa')
-        resp = self.test_auth.authorize(req)
-        self.assertEquals(resp and resp.status_int, 401)
-        req = Request.blank('/v1/AUTH_cfa')
-        req.acl = '.r:*'
-        self.assertEquals(self.test_auth.authorize(req), None)
-        req = Request.blank('/v1/AUTH_cfa')
-        req.acl = '.r:.example.com'
-        resp = self.test_auth.authorize(req)
-        self.assertEquals(resp and resp.status_int, 401)
-        req = Request.blank('/v1/AUTH_cfa')
-        req.referer = 'http://www.example.com/index.html'
-        req.acl = '.r:.example.com'
-        self.assertEquals(self.test_auth.authorize(req), None)
+        resp = self.test_authz.dev_authorize(req)
+        self.assertEquals(resp and resp.status_int, 403)
+        req = Request.blank('/v1/AUTH_cfa')
+        req.remote_user = 'act:usr,act'
+        req.acl = '.r:*'
+        self.assertEquals(self.test_authz.dev_authorize(req), None)
+        req = Request.blank('/v1/AUTH_cfa')
+        req.remote_user = 'act:usr,act'
+        req.acl = '.r:.example.com'
+        resp = self.test_authz.dev_authorize(req)
+        self.assertEquals(resp and resp.status_int, 403)
+        req = Request.blank('/v1/AUTH_cfa')
+        req.remote_user = 'act:usr,act'
+        req.referer = 'http://www.example.com/index.html'
+        req.acl = '.r:.example.com'
+        self.assertEquals(self.test_authz.dev_authorize(req), None)
+        req = Request.blank('/v1/AUTH_cfa')
+        resp = self.test_authz.dev_authorize(req)
+        self.assertEquals(resp and resp.status_int, 401)
+        req = Request.blank('/v1/AUTH_cfa')
+        req.acl = '.r:*'
+        self.assertEquals(self.test_authz.dev_authorize(req), None)
+        req = Request.blank('/v1/AUTH_cfa')
+        req.acl = '.r:.example.com'
+        resp = self.test_authz.dev_authorize(req)
+        self.assertEquals(resp and resp.status_int, 401)
+        req = Request.blank('/v1/AUTH_cfa')
+        req.referer = 'http://www.example.com/index.html'
+        req.acl = '.r:.example.com'
+        self.assertEquals(self.test_authz.dev_authorize(req), None)
 
     def test_account_put_permissions(self):
         req = Request.blank('/v1/AUTH_new', environ={'REQUEST_METHOD': 'PUT'})
         req.remote_user = 'act:usr,act'
-        resp = self.test_auth.authorize(req)
+        resp = self.test_authz.dev_authorize(req)
         self.assertEquals(resp and resp.status_int, 403)
 
         req = Request.blank('/v1/AUTH_new', environ={'REQUEST_METHOD': 'PUT'})
         req.remote_user = 'act:usr,act,AUTH_other'
-        resp = self.test_auth.authorize(req)
+        resp = self.test_authz.dev_authorize(req)
         self.assertEquals(resp and resp.status_int, 403)
 
         # Even PUTs to your own account as account admin should fail
         req = Request.blank('/v1/AUTH_old', environ={'REQUEST_METHOD': 'PUT'})
         req.remote_user = 'act:usr,act,AUTH_old'
-        resp = self.test_auth.authorize(req)
+        resp = self.test_authz.dev_authorize(req)
         self.assertEquals(resp and resp.status_int, 403)
 
         req = Request.blank('/v1/AUTH_new', environ={'REQUEST_METHOD': 'PUT'})
         req.remote_user = 'act:usr,act,.reseller_admin'
-        resp = self.test_auth.authorize(req)
+        resp = self.test_authz.dev_authorize(req)
         self.assertEquals(resp, None)
 
         # .super_admin is not something the middleware should ever see or care
         # about
         req = Request.blank('/v1/AUTH_new', environ={'REQUEST_METHOD': 'PUT'})
         req.remote_user = 'act:usr,act,.super_admin'
-        resp = self.test_auth.authorize(req)
+        resp = self.test_authz.dev_authorize(req)
         self.assertEquals(resp and resp.status_int, 403)
 
     def test_account_delete_permissions(self):
         req = Request.blank('/v1/AUTH_new',
                             environ={'REQUEST_METHOD': 'DELETE'})
         req.remote_user = 'act:usr,act'
-        resp = self.test_auth.authorize(req)
+        resp = self.test_authz.dev_authorize(req)
         self.assertEquals(resp and resp.status_int, 403)
 
         req = Request.blank('/v1/AUTH_new',
                             environ={'REQUEST_METHOD': 'DELETE'})
         req.remote_user = 'act:usr,act,AUTH_other'
-        resp = self.test_auth.authorize(req)
+        resp = self.test_authz.dev_authorize(req)
         self.assertEquals(resp and resp.status_int, 403)
 
         # Even DELETEs to your own account as account admin should fail
         req = Request.blank('/v1/AUTH_old',
                             environ={'REQUEST_METHOD': 'DELETE'})
         req.remote_user = 'act:usr,act,AUTH_old'
-        resp = self.test_auth.authorize(req)
+        resp = self.test_authz.dev_authorize(req)
         self.assertEquals(resp and resp.status_int, 403)
 
         req = Request.blank('/v1/AUTH_new',
                             environ={'REQUEST_METHOD': 'DELETE'})
         req.remote_user = 'act:usr,act,.reseller_admin'
-        resp = self.test_auth.authorize(req)
+        resp = self.test_authz.dev_authorize(req)
         self.assertEquals(resp, None)
 
         # .super_admin is not something the middleware should ever see or care
@@ -463,7 +501,7 @@
         req = Request.blank('/v1/AUTH_new',
                             environ={'REQUEST_METHOD': 'DELETE'})
         req.remote_user = 'act:usr,act,.super_admin'
-        resp = self.test_auth.authorize(req)
+        resp = self.test_authz.dev_authorize(req)
         self.assertEquals(resp and resp.status_int, 403)