davidpcls · davidpcls · Jun 22, 2026 · Jun 24, 2026 · Jun 25, 2026 · Jun 25, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -48,7 +48,7 @@ jobs:
         python-version: ${{ matrix.python-version }}
 
     - name: Install tiled
-      run: uv sync --all-extras
+      run: uv sync --all-extras --with "bluesky-authentication @ git+https://github.com/davidpcls/bluesky-authentication.git@main"
 
     # TODO Find a new image to use.
     # https://github.com/bluesky/tiled/issues/1109
@@ -128,7 +128,7 @@ jobs:
         python-version: ${{ matrix.python-version }}
 
     - name: Install tiled
-      run: uv sync --all-extras
+      run: uv sync --all-extras --with "bluesky-authentication @ git+https://github.com/davidpcls/bluesky-authentication.git@main"
       env:
         TILED_BUILD_SKIP_UI: 1
 

diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
@@ -21,7 +21,7 @@ jobs:
         python-version: ${{ matrix.python-version }}
 
     - name: Install tiled
-      run: uv sync --all-extras --group docs
+      run: uv sync --all-extras --group docs --with "bluesky-authentication @ git+https://github.com/davidpcls/bluesky-authentication.git@main"
 
     - name: Build Docs
       shell: bash -l {0}

diff --git a/.github/workflows/publish-docs.yml b/.github/workflows/publish-docs.yml
@@ -32,7 +32,7 @@ jobs:
         python-version: ${{ matrix.python-version }}
 
     - name: Install tiled
-      run: uv sync --all-extras --group docs
+      run: uv sync --all-extras --group docs --with "bluesky-authentication @ git+https://github.com/davidpcls/bluesky-authentication.git@main"
 
     - name: Build Docs
       shell: bash -l {0}

diff --git a/README.md b/README.md
@@ -30,6 +30,7 @@ on the `conda-forge` channel, which pixi uses by default.
 
 See [Getting Started][] for more detailed installation instructions.
 
+
 ## First Steps
 
 See [What is Tiled?][] for an overview of Tiled's goals. Then see

diff --git a/config.example.yml b/config.example.yml
@@ -162,6 +162,10 @@
 # Authentication
 # -----------------------------------------------------------------------------
 authentication:
+  # Canonical authenticator import path:
+  #   bluesky_authentication.authenticators:ClassName
+  # Backward-compatible legacy path still supported:
+  #   tiled.authenticators:ClassName
 
   # ---------------------------------------------------------------------------
   # Identity Providers
@@ -176,7 +180,7 @@ authentication:
   #
   # providers:
   #   - provider: local
-  #     authenticator: tiled.authenticators:PAMAuthenticator
+  #     authenticator: bluesky_authentication.authenticators:PAMAuthenticator
   #     args:
   #       service: login         # PAM service name. Default is "login".
 
@@ -200,7 +204,7 @@ authentication:
   #
   # providers:
   #   - provider: google          # Must match the label used in the redirect URIs above
-  #     authenticator: tiled.authenticators:OIDCAuthenticator
+  #     authenticator: bluesky_authentication.authenticators:OIDCAuthenticator
   #     args:
   #       audience: tiled         # Checked against the "aud" claim in the token
   #       client_id: YOUR_CLIENT_ID_HERE
@@ -226,7 +230,7 @@ authentication:
   #
   # providers:
   #   - provider: toy
-  #     authenticator: tiled.authenticators:DictionaryAuthenticator
+  #     authenticator: bluesky_authentication.authenticators:DictionaryAuthenticator
   #     args:
   #       users_to_passwords:
   #         alice: ${ALICE_PASSWORD}
@@ -239,7 +243,7 @@ authentication:
   #
   # providers:
   #   - provider: toy
-  #     authenticator: tiled.authenticators:DummyAuthenticator
+  #     authenticator: bluesky_authentication.authenticators:DummyAuthenticator
 
 
   # ---------------------------------------------------------------------------

diff --git a/docs/source/conf.py b/docs/source/conf.py
@@ -324,7 +324,7 @@ def parse_schema(d, md=[], depth=0, pre=""):
         providers=[
             AuthenticationProviderSpec(
                 provider="dummy",
-                authenticator="tiled.authenticators:DummyAuthenticator",
+                authenticator="bluesky_authentication.authenticators:DummyAuthenticator",
             )
         ]
     ),

diff --git a/docs/source/explanations/security.md b/docs/source/explanations/security.md
@@ -132,6 +132,10 @@ Tiled is designed to integrate with external user-management systems via a plugg
 Authenticator interface. For those familiar with JupyterHub, these are very
 similar to JupyterHub Authenticators. Authenticators fall into two groups:
 
+The canonical import path for built-in authenticators is
+`bluesky_authentication.authenticators:*`. For backward compatibility,
+`tiled.authenticators:*` remains supported for existing configurations.
+
 * Authenticators that accept user credentials directly, following the OAuth2 and
   OpenAPI standards as shown below, and validate the credentials using some
   underlying authentication mechanism, such as PAM.
@@ -176,7 +180,7 @@ The configuration file(s) should include:
 
 ```yaml
 authentication:
-  authenticator: tiled.authenticators:PAMAuthenticator
+  authenticator: bluesky_authentication.authenticators:PAMAuthenticator
 ```
 
 Here is a complete working example:
@@ -185,7 +189,7 @@ Here is a complete working example:
 # pam_config.yml
 authentication:
   providers:
-    - authenticator: tiled.authenticators:PAMAuthenticator
+    - authenticator: bluesky_authentication.authenticators:PAMAuthenticator
       # This 'provider' can be any string; it is used to differentiate
       # authentication providers when multiple ones are supported.
       provider: local
@@ -251,7 +255,7 @@ The configuration file(s) must include the following.
 authentication:
   providers:
   - provider: example.com
-    authenticator: tiled.authenticators:OIDCAuthenticator
+    authenticator: bluesky_authentication.authenticators:OIDCAuthenticator
     args:
       # Values should come from your OIDC provider configuration
       # The audience claim is checked by the OIDC Client (Tiled)
@@ -282,7 +286,7 @@ should only for used for development and demos.
 authentication:
   providers:
   - provider: toy
-    authenticator: tiled.authenticators:DictionaryAuthenticator
+    authenticator: bluesky_authentication.authenticators:DictionaryAuthenticator
     args:
       users_to_passwords:
         alice: ${ALICE_PASSWORD}
@@ -304,7 +308,7 @@ The ``DummyAuthenticator`` accepts *any* username and password combination.
 authentication:
   providers:
   - provider: toy
-    authenticator: tiled.authenticators:DummyAuthenticator
+    authenticator: bluesky_authentication.authenticators:DummyAuthenticator
 trees:
   - path: /
     tree: tiled.examples.generated_minimal:tree

diff --git a/example_configs/external_service/custom.py b/example_configs/external_service/custom.py
@@ -1,7 +1,7 @@
 import numpy
+from bluesky_authentication.protocols import UserSessionState
 
 from tiled.adapters.array import ArrayAdapter
-from tiled.authenticators import UserSessionState
 from tiled.server.protocols import InternalAuthenticator
 from tiled.structures.core import StructureFamily
 

diff --git a/example_configs/google_auth.yml b/example_configs/google_auth.yml
@@ -2,7 +2,7 @@
 authentication:
   providers:
   - provider: google
-    authenticator: tiled.authenticators:OIDCAuthenticator
+    authenticator: bluesky_authentication.authenticators:OIDCAuthenticator
     args:
       audience: tiled  # something unique to ensure received headers are for you
       # These values come from https://console.cloud.google.com/apis/credential

diff --git a/example_configs/keycloak_oidc/config.yaml b/example_configs/keycloak_oidc/config.yaml
@@ -1,7 +1,7 @@
 authentication:
   providers:
   - provider: keycloak_oidc
-    authenticator: tiled.authenticators:ProxiedOIDCAuthenticator
+    authenticator: bluesky_authentication.authenticators:ProxiedOIDCAuthenticator
     args:
       audience: tiled_aud
       client_id: tiled

diff --git a/example_configs/multiple_providers.yml b/example_configs/multiple_providers.yml
@@ -1,21 +1,21 @@
 authentication:
   providers:
   - provider: one
-    authenticator: tiled.authenticators:DictionaryAuthenticator
+    authenticator: bluesky_authentication.authenticators:DictionaryAuthenticator
     args:
       users_to_passwords:
         alice: ${ALICE_PASSWORD}
         bob: ${BOB_PASSWORD}
         cara: ${CARA_PASSWORD}
   - provider: two
-    authenticator: tiled.authenticators:DictionaryAuthenticator
+    authenticator: bluesky_authentication.authenticators:DictionaryAuthenticator
     args:
       users_to_passwords:
         alice: ${ALICE_PASSWORD}
         bob: ${BOB_PASSWORD}
         cara: ${CARA_PASSWORD}
   - provider: three
-    authenticator: tiled.authenticators:DictionaryAuthenticator
+    authenticator: bluesky_authentication.authenticators:DictionaryAuthenticator
     args:
       users_to_passwords:
         alice: ${ALICE_PASSWORD}

diff --git a/example_configs/orcid_auth.yml b/example_configs/orcid_auth.yml
@@ -2,7 +2,7 @@
 authentication:
   providers:
   - provider: orcid
-    authenticator: tiled.authenticators:OIDCAuthenticator
+    authenticator: bluesky_authentication.authenticators:OIDCAuthenticator
     args:
       audience: tiled  # something unique to ensure received headers are for you
       # These values come from https://orcid.org/developer-tools

diff --git a/example_configs/saml.yml b/example_configs/saml.yml
@@ -4,7 +4,7 @@
 authentication:
   providers:
   - provider: saml
-    authenticator: tiled.authenticators:SAMLAuthenticator
+    authenticator: bluesky_authentication.authenticators:SAMLAuthenticator
     args:
       attribute_name: "email"
       saml_settings:

diff --git a/example_configs/simple_oidc/config.yml b/example_configs/simple_oidc/config.yml
@@ -7,7 +7,7 @@
 authentication:
   providers:
   - provider: simple_oidc
-    authenticator: tiled.authenticators:OIDCAuthenticator
+    authenticator: bluesky_authentication.authenticators:OIDCAuthenticator
     args:
       audience: ${OIDC_CLIENT_ID}
       client_id: ${OIDC_CLIENT_ID}

diff --git a/example_configs/toy_authentication.yml b/example_configs/toy_authentication.yml
@@ -1,7 +1,7 @@
 authentication:
   providers:
   - provider: toy
-    authenticator: tiled.authenticators:DictionaryAuthenticator
+    authenticator: bluesky_authentication.authenticators:DictionaryAuthenticator
     args:
       users_to_passwords:
         alice: ${ALICE_PASSWORD}

diff --git a/pyproject.toml b/pyproject.toml
@@ -19,6 +19,7 @@ requires-python = ">=3.10"
 # data structures you care about.
 # Use pip install tiled[all] to get everything.
 dependencies = [
+    "bluesky-authentication",
     "httpx >=0.20.0,!=0.23.1",
     "json-merge-patch",
     "jsonpatch",

diff --git a/tests/conftest.py b/tests/conftest.py
@@ -373,7 +373,7 @@ def minio_uri():
     "providers": [
         {
             "provider": "toy",
-            "authenticator": "tiled.authenticators:DictionaryAuthenticator",
+            "authenticator": "bluesky_authentication.authenticators:DictionaryAuthenticator",
             "args": {
                 "users_to_passwords": {"alice": "secret1", "bob": "secret2"},
             },

diff --git a/tests/test_access_control.py b/tests/test_access_control.py
@@ -34,7 +34,7 @@
         "providers": [
             {
                 "provider": "toy",
-                "authenticator": "tiled.authenticators:DictionaryAuthenticator",
+                "authenticator": "bluesky_authentication.authenticators:DictionaryAuthenticator",
                 "args": {
                     "users_to_passwords": {
                         "alice": "alice",

diff --git a/tests/test_authentication.py b/tests/test_authentication.py
@@ -260,12 +260,12 @@ def test_multiple_providers(enter_username_password, config, monkeypatch):
         [
             {
                 "provider": "second",
-                "authenticator": "tiled.authenticators:DictionaryAuthenticator",
+                "authenticator": "bluesky_authentication.authenticators:DictionaryAuthenticator",
                 "args": {"users_to_passwords": {"cara": "secret3", "doug": "secret4"}},
             },
             {
                 "provider": "third",
-                "authenticator": "tiled.authenticators:DictionaryAuthenticator",
+                "authenticator": "bluesky_authentication.authenticators:DictionaryAuthenticator",
                 "args": {
                     # Duplicate 'cara' username.
                     "users_to_passwords": {"cara": "secret5", "emilia": "secret6"}
@@ -292,12 +292,12 @@ def test_multiple_providers_name_collision(config):
     config["authentication"]["providers"] = [
         {
             "provider": "some_name",
-            "authenticator": "tiled.authenticators:DictionaryAuthenticator",
+            "authenticator": "bluesky_authentication.authenticators:DictionaryAuthenticator",
             "args": {"users_to_passwords": {"cara": "secret3", "doug": "secret4"}},
         },
         {
             "provider": "some_name",  # duplicate!
-            "authenticator": "tiled.authenticators:DictionaryAuthenticator",
+            "authenticator": "bluesky_authentication.authenticators:DictionaryAuthenticator",
             "args": {
                 # Duplicate 'cara' username.
                 "users_to_passwords": {"cara": "secret5", "emilia": "secret6"}
Original file line number	Diff line number	Diff line change
Expand Up		@@ -30,6 +30,7 @@ on the `conda-forge` channel, which pixi uses by default.

		See [Getting Started][] for more detailed installation instructions.


		## First Steps

		See [What is Tiled?][] for an overview of Tiled's goals. Then see
Expand Down