"dynamic permissions" in zope
Hi, I'm very new to zope and have to eximine, if it's usable for our requirements. The question I have, is very simple or perhaps very difficult, I don't know. Our requrements are a permissioning system which depends on a matrix: There are two independend qualities which describe, if a user is allowed to see a document. This can be displayed in a matrix. Only if *both* qualities match, the user is allowed to see it. As far as I understand zope, it is not possible to map this directly (as by all other systems I know). So my question: Is it possible to connect a permission (or role) in zope with a method (instead of a static flag which was set)? If it is possible, it should be possible to call a special algorithm with this request, which can implement whatever is needed. So, it would be (easy) possible to *integrate* this functionality. (I called this permissions "dynamic", because the are evaluated when requestet.) Or does anybody has another (better) idea? Any help is very apreciated, Heinz-Josef Claes hjclaes@web.de
Heinz-Josef Claes wrote:
Our requrements are a permissioning system which depends on a matrix: There are two independend qualities which describe, if a user is allowed to see a document. This can be displayed in a matrix. Only if *both* qualities match, the user is allowed to see it. As far as I understand zope, it is not possible to map this directly (as by all other systems I know).
So my question: Is it possible to connect a permission (or role) in zope with a method (instead of a static flag which was set)? If it is possible, it should be possible to call a special algorithm with this request, which can implement whatever is needed. So, it would be (easy) possible to *integrate* this functionality. (I called this permissions "dynamic", because the are evaluated when requestet.)
I believe the latest LoginManager allows you to specify what roles a user has, and compute these each request, based on the details of the request. This is probably more useful than having dynamically computed permissions; While I can see how a user's roles will vary according to where they are, what they are doing and when they are doing it, I cannot see why permissions need to change in that way. However, you mention that you are new to Zope. ZPatterns can be difficult to understand and get into. Other than the creators of ZPatterns, I haven't heard of anyone using this computed permissions system. -- Steve Alexander Software Engineer Cat-Box limited http://www.cat-box.net
Steve Alexander wrote:
I believe the latest LoginManager allows you to specify what roles a user has, and compute these each request, based on the details of the request.
This is probably more useful than having dynamically computed permissions; While I can see how a user's roles will vary according to where they are, what they are doing and when they are doing it, I cannot see why permissions need to change in that way.
However, you mention that you are new to Zope. ZPatterns can be difficult to understand and get into. Other than the creators of ZPatterns, I haven't heard of anyone using this computed permissions system.
What I forgot to mention: LoginManager is a Zope product that is built using ZPatterns, another Zope product. When you are doing advanced things with LoginManager, you need to know how ZPatterns works. There are a couple of HOWTO documents on using LoginManager. It will be only a small change to alter the "userRoles" method that returns the roles a user should have to calculate these roles based on other criteria. See these documents for information about how to set up LoginManager. http://www.zope.org/Members/dlpierson/sqlLogin http://www.zope.org/Members/jok/SQL_based_LoginManager -- Steve Alexander Software Engineer Cat-Box limited http://www.cat-box.net
participants (2)
-
Heinz-Josef Claes -
Steve Alexander