Hello, I was thinking about how to do an abstracted authorization component and WOW! Here's GUF! This is really great! I ran into a bit of a snag, though. It's not actually a problem with GUF (it's not really a problem at all for most ;), it just brought it out. It also provided a way to maybe fix it without bothering anything else. I have a site that I'm trying to set up that needs to authenticate some 2,600+ users from a database. When I first tried out GUF, I found it horribly slow. After poking around for a while, I found that the cause of this was the calls to getUserNames from getUsers and getUser which are called by BasicUserFolder.validate. Basically, what happens is for every validation call, my userList query is called and a list of 2,600+ items is created and searched for a user. So I added a hook called userName to call instead of getUserNames. It works like the other hook methods and returns the user name if it checks out. That speeded things up when logged in. When there is no authorization information, a list of 2,600+ user objects gets created in order to search for domain information. I have to admit that I don't understand the domain checking bit. It's really slow. I don't use domains so I copied BasicUserFolder.validate over to GenericUserFolder and erased that part. *cringe* There should be some way to fix it to make it work. Major speed improvement, though. Another thing--since the authorization has been abstracted out, the call to userName for web authentication doesn't seem necessary. The userAuthorize can be passed a dummy user object and accept or reject the username and password from there. One less SQL call for me. This is getting too long. Here's a diff against GenericUserFolder.py from version 1.0.4. PLEASE PLEASE PLEASE don't try this on a production server! Domains and who knows what else are broken. And I could be absolutely looney! And Thank You!!! John Jarvis <<GenericUserFolder.py.diff.gz>>