Get rid of login_required decorator from roles_required and roles_accepted in order to be able to pair http_auth_required with roles_required or roles_accepted. Just be sure to put http_auth_required first.

flask_security/decorators.py

@@ -13,7 +13,7 @@ from functools import wraps
 
 from flask import current_app, Response, request, redirect
 from flask.ext.login import login_required, login_url, current_user
-from flask.ext.principal import RoleNeed, Permission
+from flask.ext.principal import RoleNeed, Permission, Identity, identity_changed
 from werkzeug.local import LocalProxy
 
 from . import utils
@@ -77,7 +77,13 @@ def _check_http_auth():
     except UserNotFoundError:
         return False
 
-    return _security.pwd_context.verify(auth.password, user.password)
+    rv = _security.pwd_context.verify(auth.password, user.password)
+
+    if rv:
+        identity_changed.send(current_app._get_current_object(),
+                              identity=Identity(user.id))
+
+    return rv
 
 
 def http_auth_required(realm):
@@ -132,7 +138,6 @@ def roles_required(*roles):
     def wrapper(fn):
 
         @wraps(fn)
-        @login_required
         def decorated_view(*args, **kwargs):
             perms = [Permission(RoleNeed(role)) for role in roles]
 
@@ -167,7 +172,6 @@ def roles_accepted(*roles):
     def wrapper(fn):
 
         @wraps(fn)
-        @login_required
         def decorated_view(*args, **kwargs):
             perm = Permission(*[RoleNeed(role) for role in roles])
 

tests/functional_tests.py

@@ -88,7 +88,7 @@ class DefaultSecurityTests(SecurityTest):
 
     def test_unauthenticated_role_required(self):
         r = self._get('/admin', follow_redirects=True)
-        self.assertIn('<input id="next"', r.data)
+        self.assertIn('You do not have permission to view this resource', r.data)
 
     def test_multiple_role_required(self):
         for user in ("matt@lp.com", "joe@lp.com"):