Module: zmq.auth.asyncio#

ZAP Authenticator integrated with the asyncio IO loop.

Added in version 15.2.



class zmq.auth.asyncio.AsyncioAuthenticator(context: Context | None = None, loop: Any = None, encoding: str = 'utf-8', log: Any = None)#

ZAP authentication for use in the asyncio IO loop

allow(*addresses: str) None#

Allow IP address(es).

Connections from addresses not explicitly allowed will be rejected.

  • For NULL, all clients from this address will be accepted.

  • For real auth setups, they will be allowed to continue with authentication.

allow is mutually exclusive with deny.

allow_any: bool#
certs: Dict[str, Dict[bytes, Any]]#
configure_curve(domain: str = '*', location: str | PathLike = '.') None#

Configure CURVE authentication for a given domain.

CURVE authentication uses a directory that holds all public client certificates, i.e. their public keys.

To cover all domains, use “*”.

You can add and remove certificates in that directory at any time. configure_curve must be called every time certificates are added or removed, in order to update the Authenticator’s state

To allow all client keys without checking, specify CURVE_ALLOW_ANY for the location.

configure_curve_callback(domain: str = '*', credentials_provider: Any = None) None#

Configure CURVE authentication for a given domain.

CURVE authentication using a callback function validating the client public key according to a custom mechanism, e.g. checking the key against records in a db. credentials_provider is an object of a class which implements a callback method accepting two parameters (domain and key), e.g.:

class CredentialsProvider(object):

    def __init__(self):
        ...e.g. db connection

    def callback(self, domain, key):
        valid = ...lookup key and/or domain in db
        if valid:
  'Authorizing: {0}, {1}'.format(domain, key))
            return True
            logging.warning('NOT Authorizing: {0}, {1}'.format(domain, key))
            return False

To cover all domains, use “*”.

configure_gssapi(domain: str = '*', location: str | None = None) None#

Configure GSSAPI authentication

Currently this is a no-op because there is nothing to configure with GSSAPI.

configure_plain(domain: str = '*', passwords: Dict[str, str] | None = None) None#

Configure PLAIN authentication for a given domain.

PLAIN authentication uses a plain-text password file. To cover all domains, use “*”. You can modify the password file at any time; it is reloaded automatically.

context: zmq.Context#
credentials_providers: Dict[str, Any]#
curve_user_id(client_public_key: bytes) str#

Return the User-Id corresponding to a CURVE client’s public key

Default implementation uses the z85-encoding of the public key.

Override to define a custom mapping of public key : user-id

This is only called on successful authentication.


client_public_key (bytes) – The client public key used for the given message


user_id – The user ID as text

Return type:


deny(*addresses: str) None#

Deny IP address(es).

Addresses not explicitly denied will be allowed to continue with authentication.

deny is mutually exclusive with allow.

encoding: str#
async handle_zap_message(msg: List[bytes])#

Perform ZAP authentication

log: Any#
passwords: Dict[str, Dict[str, str]]#
start() None#

Start ZAP authentication

stop() None#

Stop ZAP authentication

zap_socket: zmq.Socket#