stash

backend/authentication/signature_auth.py

@@ -106,11 +106,19 @@ def authenticate_request_against_local_users(request, raw_request_body):
 
 class SignatureAuthentication(authentication.BaseAuthentication):
     def authenticate(self, request):
-        return authenticate_request_against_known_identities(
-            request, request.body.decode('utf-8')), None
+        identity = authenticate_request_against_known_identities(request, request.body.decode('utf-8'))
+        # Returning a bare None (rather than a (None, None) tuple) tells DRF this
+        # authenticator doesn't apply, so it moves on to the next authenticator in the
+        # authentication_classes list instead of treating the request as authenticated
+        # with an empty user.
+        if identity is None:
+            return None
+        return identity, None
 
 
 class SignatureAuthenticationLocal(authentication.BaseAuthentication):
     def authenticate(self, request):
-        return authenticate_request_against_local_users(
-            request, request.body.decode('utf-8')), None
+        user = authenticate_request_against_local_users(request, request.body.decode('utf-8'))
+        if user is None:
+            return None
+        return user, None