From: "Florent Guillaume" <fg@nuxeo.com>
- I really don't like the term groups or workgroups for what you have, because I see them as mappings between two kinds of concepts (the users and the roles) whereas groups implies only one kind of thing.
Well, they are collections of user, and hence they are what groups are usually ment to be. They do have the additional information of giving the users roles. If somebody can come up with a better name, that's not a problem for me. Teams? Departments? Grüpps? Roled principal collections? :-) In any case, I think it would be a good idea to have the word "group" somewhere in the user interface. It is obvious that people when looking at the access control in Zope are actively looking for the groups. Today they find roles, and mistake them for groups, causing much confusion. :-)
- For the Blacklist part, I'd like to propose slightly different semantics with respect to the white and black lists. Basically I'd like them to be exclusive: if someone is on the whitelist he cannot be on the blacklist, and vice versa. This cleans up some behavior of the UI that the user would find nonintuitive.
Maybe, I'll disuss it with Johan, and we'll see. The user interface as it stands is more or less ad hoc.
The other thing we will have to resolve (and it's also true for Zope 3 anyway) is how user groups will interact with the blocking that blacklists provide. Is the blacklist evaluated first, or is it the whitelist ?
Yup. As it is now the blacklist blocks out roles gotten from local roles or via group assignments, but not global roles. Which way it should be is definitly a matter for discussion. It would also be possible to have unissigned blacklists, that blocks a role for all users. In that case it could be useful to let group roles override a blocklist. There are endless possibilities for detailed design changes. Ideas and thoughts are most welcome. And in true XP fashion, the ideas with the most use and least cost (in this case I'd define cost as making things complicated to use) will be implemented first. Having an easy UI while having a high flexibility is always hard.