Q:

Pyramid: Is it possible to use Authorization without Authentication?

My organization uses OpenAM SSO for authentication and my app is written in Pyramid. 
The user id will be passed in HTTP header. I can also configure it to pass groups and permissions as well which I can use in  acl. This makes the authentication in pyramid redundant. Is it possible to do away with Authenticaion Policy altogether and go with authorization alone?

A:

You need a way to tell pyramid's authorization system who the person is (their effective principals). That is the responsibility of the authentication policy, even if it's something as simple as parsing a header.
class CustomAuthenticationPolicy(object):
    def effective_principals(self, request):
        principals = [Everyone]

        identity = request.headers.get('x-identity')
        # validate the identity somehow
        if is_valid(identity):
            principals += [Authenticated, identity, 'g:editors']
        return principals

config.set_authentication_policy(CustomAuthenticationPolicy())

