Python: Using getpass with argparse

I think I might have found a nicer way to do it. How about using a custom Action like this:

import argparse
import getpass

class PasswordPromptAction(argparse.Action):
    def __init__(self,
             option_strings,
             dest=None,
             nargs=0,
             default=None,
             required=False,
             type=None,
             metavar=None,
             help=None):
        super(PasswordPromptAction, self).__init__(
             option_strings=option_strings,
             dest=dest,
             nargs=nargs,
             default=default,
             required=required,
             metavar=metavar,
             type=type,
             help=help)

    def __call__(self, parser, args, values, option_string=None):
        password = getpass.getpass()
        setattr(args, self.dest, password)

parser.add_argument('-u', dest='user', type=str, required=True)
parser.add_argument('-p', dest='password', action=PasswordPromptAction, type=str, required=True)

args = parser.parse_args()

After looking around and not finding a sufficient solution. Here is what I came up with.

from argparse import ArgumentParser
from getpass import getpass

def main():
    parser = ArgumentParser(description="arg parser hidden password input.")
    parser.add_argument('-sp', '--secure_password', action='store_true', dest='password', 
                        help='hidden password prompt')
    args=parser.parse_args()

    if args.password:
        password = getpass()

    print(password)

if __name__ == "__main__":
    main()

Obviously you would want to remove print(password), this is just added to verify it works.

Here's what I came up with for prompting for a password that's pretty minimal (Python 3 code):

import argparse
import getpass


class Password:

    DEFAULT = 'Prompt if not specified'

    def __init__(self, value):
        if value == self.DEFAULT:
            value = getpass.getpass('LDAP Password: ')
        self.value = value

    def __str__(self):
        return self.value


parser = argparse.ArgumentParser(
    formatter_class=argparse.ArgumentDefaultsHelpFormatter)
parser.add_argument('-u', '--username', help='Specify username',
    default=getpass.getuser())
parser.add_argument('-p', '--password', type=Password, help='Specify password',
    default=Password.DEFAULT)
args = parser.parse_args()

print(args.username, args.password)

Usage example:

$ python ~/Desktop/example.py -h
usage: example.py [-h] [-u USERNAME] [-p PASSWORD]

optional arguments:
  -h, --help            show this help message and exit
  -u USERNAME, --username USERNAME
                        Specify username (default: gavinr)
  -p PASSWORD, --password PASSWORD
                        Specify password (default: Prompt if not specified)

$ python ~/Desktop/example.py -p foo
gavinr foo

$ python ~/Desktop/example.py 
LDAP Password: 
gavinr foo

Based on the answer of Rares Musina I've noticed one shortcoming: When the password is submitted on the commandline the prompt keeps appearing. When a password is then supplied via the prompt, argparse will consider the password already given on the commandline as another argument (which most likely won't exist).

In the ideal scenario this is the expected behaviour:

• password prompt when no value is given on commandline
• no prompt when a value is given on the commandline

Both cases should be accepted. Ideally, the second case should give a security warning.

When setting nargs to '?' it expects either zero or one argument. This makes it optional supply the password via the commandline.

So change 'add_argument' to:

arg_parser.add_argument("-p", "--password", type=str, action=PasswordPromptAction, nargs='?')

The PasswordPromptAction should be edited to make a distinction. The 'values' parameter contains the value given on the commandline (in case one was given):

class PasswordPromptAction(argparse.Action):
    def __call__(self, parser, args, values, option_string=None):
        # If no value is given on the commandline prompt for password.
        if values:
            # Ideally a security warning could be generated here.
            setattr(args, self.dest, values)
        else:
            setattr(args, self.dest, getpass.getpass())

Following usages are now supported:

python program.py -p
python program.py -p p@ssw0rd

This will prompt using getpass() if password is not specified in command. Nice because it supports automated scripts and manual use with hidden password.

import argparse
from getpass import getpass

parser = argparse.ArgumentParser(description="specify or prompt for a hidden password.")
parser.add_argument('-p', '--password', required=False, type=str)
args = parser.parse_args()

if not args.password: 
    args.password = getpass()

I like this solution because the user can pass both:

$> python program.py login -u user1 -p pass1

or just one:

$> python program.py login -u user1

or any:

$> python program.py login

If user or password are not passed by param are requested interactively.

import argparse
import getpass

def parse_args():
    parser = argparse.ArgumentParser(description="command line client")
    subparser = parser.add_subparsers(dest='command', metavar='command')
    subparser.required = True
    parser.set_defaults(funct=argparser_handler)

    # Login
    sub_parser = subparser.add_parser("login", help="Login with email and password")
    sub_parser.add_argument('-u', dest='user', help='user.  If this argument is not passed it will be requested.')
    sub_parser.add_argument('-p', dest='password', help='password.  If this argument is not passed it will be requested.')

    args = parser.parse_args()
    args.funct(args)

def argparser_handler(args):
    if (args.command == 'login'):
        login(args.user, args.password)


def login(user, password):
    if not user:
        user = input("User:") 
    if not password:
        password = getpass.getpass()    
    print("user:", user)
    print("password:", password)


def main():
    pass

if __name__ == '__main__':
    parse_args()
    main()