November 1999 - Zope

Short Zope Security Question
by Alexander Limi 22 Nov '99

22 Nov '99

Just a quick question: When you log on as a user in a Zope, is it possible to authenticate users via a secure connection easily? (via SSL, aka. https). I find it a bit discomforting when people can monitor the network and sniff the passwords used to access the folders of my users. (I know the superuser password is relatively safe because of the IP-check, but ideally this should also be SSL encrypted. Thanks in advance, Alexander Limi mp3.no

3 2

zope scalability
by Ben White 22 Nov '99

22 Nov '99

Hi, I am new to Zope -- really excited about it -- but have a few basic questions (which I'm sure have been asked before). 1. How well does Zope scale? Is anybody out there using this for high traffic sites? We have been using a custom blend of PHP and Mysql for a busy site and it works pretty well (although MySQL seems to choke when we get really slammed). How well does Zope scale? 2. How fast is Zope? And how does it compare to the PHP/MySQL combo? Are their any benchmarks available? It seems pretty quick but I'm not sure what type of transactions are going on below the surface of the pages I'm looking at. 3. How well does Zope work with MySQL? We have built some pretty serious backend with PHP and MySQL and I'd love to be able to keep our database structure etc. 4. Migrating What is the best way to migrate from a traditional web structure to Zope? For instance do you have to rebuild and register all of your objects with Zope through the web interface? Or can you upload files and have them be recognized by Zope? 5. Editors Are there any offline editors for MAC that you can get to work with Zope/DTML? Thanks for the help Ben

3 2

RE: [Zope-dev] GenericUserFolder available for beta
by Ian Blenke 22 Nov '99

22 Nov '99

This thread seems to be applicable to the Zope list as a whole. Should we Cc: the rest of the list at some point? Feel free to cut away any of my useless banter below. :) On Thur, 18 Nov 1999, Stuart 'Zen' Bishop wrote: > On Wed, 17 Nov 1999, Ian Blenke wrote: > > > 1. The README and installation guides may have a minor typo (<dtml-return > > - then what? :) > > Oops :-) No biggie. A minor oversight :) > <dtml-return "MyRadius(username=username,password=password)"> Excellent! This was rather important :) Unfortunately, the page still seems to be "locked" > > 2. Whenever I add GenericUserFolder to a folder, the folder becomes > > "locked". > > Locked as in you can no longer view the contents of the folder? Exactly that. In fact, I can no longer "manage" that folder either. I can repetitively login, but it always returns with a Login:/Password: prompt (and management of the page is impossible) > > 1. What should go after <dtml-return in the userAuthentication method? Even > > a <dtml-return 1> doesn't seem to help. > > <dtml-return "_.int('1')"> > > I'm explicity checking for a numeric 1, rather than normal truth checking. > I do this, as otherwise it would be too easy to stuff up and write > <dtml-return 0> which would probably evaluate to true (possibly being > a string and all, or a zope object with an id of '0' that was aquired, > or something). Ouch. That would be bad :) Trying the above workaround, I am still unable to manage the folder after using GenericUserFolder - so I'm still doing something wrong. > > 2. How do I use ZRadius to authenticate with a GenericUserFolder? (and tie a > > login to a Role) > > 3. How could I implement "groups" of users and tie them to Roles using > > ZRadius? > > ZRadius is not intelligent enough to determine a type of user from > a Radius server... and I don't know enough about Radius to know if it > is possible... I know how to put the packets together now, but most > of those attribute names are fairly meaningless to me ;-) A brief > glance at RFC2138 gives me the impressions that Radius does not support > the notion of groups in anyway. Nope. It sure doesn't. The Microsoft RADIUS server isn't going to pass back an attribute for user groups regardless of how hard I try :) > I'm pulling my groups from another source - an Oracle database in my case - > from which all my accounts are generated. The best bet is to make up my own TinyTables/SQL tables/LDAP source to correlate the login to appropriate groups. > You could pull groups out of /etc/groups and /etc/password in the final > instalation, if the NT users are duplicated on the Unix box. No such luck. I have pam_smb working (so a PAM enabled Zope authentication Product would be nice), however there is no good solution for an NSS "interworking" piece without LDAP. One solution might be to use the Microsoft "Unix Integration Kit" to get NIS /etc/passwd and/or /etc/group maps to pass through - but this would still require an NSS friendly Zope User Folder Product. Simply put: 1. etcUserFolder isn't going to work against an NT Domain - ever. 2. NTUserFolder will only work against an NT Domain if you run Zope from a BDC or PDC (local SAM database). 3. smbuserfolder only works under Linux/Solaris, with a Python hand-compiled smb_valid module (with pam_smb in your environment) 4. ZRadius/GenericUserFolder/ZLDAPConnection is the ONLY authentication solution for an NT Domain that can run under either NT or any flavor of Unix - given Microsoft's current authentication model (PDC/BDC frontended by RADIUS, and an Exchange directory server) Getting ldap_nss to "interwork" with the Microsoft Exchange server isn't a trivial task (see below :) This isn't necessarily a Bad Thing(TM). (using NSS/PAM with win32 is a fairly moot point at present) When Active Directory Services are available (give it 8-12 months before people start actively using it), perhaps a true LDAP environment may be feasible. > You could authenticate using Radius, and use the samba tools to pull > group information (or do groups and authentication using the samba tools). > Similar to smbfolder, which I havn't played with so I couldn't tell you > which one is better. Unfortunately, smbfolder isn't a simple thing to get working. You need to patch your Python distribution to build the smb_valid module. To get the smb_valid module working, you need to have pam_smb built as well. We have pam_smb built. I've built smb_valid as well. The big pain is getting this cludge to work *reliably*. More importantly: this approach WILL NOT WORK under win32. This doesn't concern me as much as it does everyone else here - but I still need to keep the site as platform-neutral as possible. > You could try running an LDAP server instead of a RADIUS server, and > either use LDAPAuthenticatior or GenericUserFolder + LDAP - LDAP should > allow both authentication and group membership direct from the NT Domain > if you can find a decent LDAP server for NT that doesn't turn your brain > to mush when you try and configure it (I decided to stick with Radius after > skimming the OpenLDAP docs...). We have an LDAP server as part of our Exchange 5.5 server. Granted, it is a useful repository of user information - but it doesn't contain the {crypt} passwords neccesary to get it to work with LDAPAuthenticator. This isn't a problem when you hook it together with your ZRadius product, however. The best part about the LDAP/RADIUS solution: it is 100% cross-platform! I have a working ZLDAPConnection pulling information from our Exchange LDAP server. Your ZRadius Product is reliably authenticating usernames/passwords every time. Both of these are working from both a win32 server as well as the Solaris 7.0 box. My biggest problem still remains: how do I get GenericUserFolder to work? (I still need to tie Zope "Roles" to these authenticated users) If you could throw together a "viable" working *.zexp showing what I'm doing wrong, I would greatly appreciate it! If not, anything you can suggest would help a great deal as well. Thanks! - Ian C. Blenke <icblenke(a)2c2.com>

3 2

announce: SQL Session 0.2.1 released.
by Anthony Baxter 22 Nov '99

22 Nov '99

SQLSession 0.2.1 is now available from http://www.zope.org/Members/anthony/software/SQLSession. This version can be installed on a system with existing SQL Session objects, unlike version 0.2.0, which broke all existing Session objects. If installing over an older version, you'll need to go to the management screen of any existing Session objects and hit the 'Change' button to upgrade them. Sorry for the glitch, Anthony

1 0

Zope Internationalization Project (ZIP)
by Alexandre Ratti 22 Nov '99

22 Nov '99

Hello Zopists, Are you interested in localisation issues for Zope? Do you want to translate Zope to your language? Are you a Zope developper with copious free time? If so, rejoice: the Zope Internationalization Project (ZIP) is meant for you. What is the purpose of ZIP? - Identify localisation problems in Zope and solve them - Outline a localisation plan for Zope so that new languages can be added easily - Keep track of i18n tips & tools - And more: IMO strategies for multilingual sites also belong here How can you participate? - Register on the ZIP list (zip(a)eevolute.com) and take part in the discussions (well actually we'll need to start discussing again because the ZIP list has been really quiet since August). To register, see the <http://www.eevolute.com/mailman/listinfo/zip> page. Cheers. Alexandre

2 1

Setting a var
by Anders Gaarsdal Holst 21 Nov '99

21 Nov '99

I have a very simple question: How do I set a variable when calling a <dtml-in> method? (I would like to use a zsql-method for more then one thing, and have therefore made a "case"-variable) Regards, A n d e r s G a a r s d a l H o l s t

2 1

Re: [Zope] Re: passing variables from one DTML method to another ...
by Doug McNaught 21 Nov '99

21 Nov '99

"Jens Vagelpohl" <tommymi(a)concentric.net> writes: > use an invisible input element in your form in this case, something like > this: > > <input type="hidden" name="variable_name" value="value"> > > this will be sent across to the form's target method with all other form > field data, and they aren't visible/editable by the person seeing the form. But they are visible by viewing the HTML source, so don't rely on them for security. -Doug -- Doug McNaught doug(a)mcnaught.org http://www.mcnaught.org/~doug

2 1

[newbie] Z SQL methods ...help!?
by Darcy Clark 21 Nov '99

21 Nov '99

I am a Zope newbie working my way through the Z SQL Methods user guide ( http://www.zope.org/Documentation/Guides/ZSQL ) .... I made a simple MySQL database, setup a connection to it, made a Z SQL method to access my database ....then I used the Search interface creation wizard to create a query form and a report page. I tested it and it works great My question has to do with alternative ways of accessing SQL data, other than by going through a html query form. Obviously one way to do it is to 'encode' the query into a URL - e.g. http://darcy.engin.umich.edu:8080/Plutonia/MySQL_test/course_report?number=… My question is as follows : my MySQL table contains 2 fields : number and title example data : number title mse242 physics of materials mse252 principles of engineering materials I want to build a folder containing a Z SQL method - this folder has a Property of 'course=mse242'. In this folder I have a page (DTML-method?) that when accessed via the browser, will *automatically* access the Z SQL method, run a query based on the property 'course=mse242' and spit out a page containing the number (mse242) and the title (physics of materials). What I want to get around is having to access a html query form to get to a particular course....I want to store the course name in a folder's properties and access this property automatically when I render any pages in that folder. Can this be done ? Can my Z-SQL methods access folder properties and then run queries on this basis ? If this is possible can you refer me to any docs that address this ? here is my current Z SQL method : select * from courses where  I guess what I am shooting for here is to utilize acquisition within Z SQL methods....I would not be surprised if I missing something *really* basic here .... curse my newbieness!! :). thanks in advance for any advice. Darcy

2 1

Zope/Apache
by ma.s+c＠bmw.de 21 Nov '99

21 Nov '99

Hello, i have tried to connect Apache/Zope and do something wrong. What i was thinking to do was Zope Multithreaded like in docs/Webservers.txt I have Apache 1.3 /Zope 2.1beta OS: SGI Irix 6.5 and Linux (Suse 6.2) Error encountered: When entering the passwort of superuser at http//localhost:80/cgi-bin/Zope.cgi/manage i get access denied What works like i did not think: I can connect to localhost:8080/ and login to Zope. Here my authentication works, but should this connect work in Multithreaded mode ? What doesn't work: The simple way: single thread: Just not starting Zserver, Copying Zope.cgi and modifiing httpd.conf. When i try this: I get Service not available when trying to connect to: http//localhost:80/cgi-bin/Zope.cgi/manage In multithreaded config: I point to Apache-cgi-bin when starting Zserver: start Script modified to: z2.py -p /usr/local/httpd/cgi-bin/Zope.cgi (I have only this dir enabled for cgi in Apache, so i can use no link !) I have the following line in httpd.conf: RewriteEngine on RewriteCond %{HTTP:Authorization} ^(.*) RewriteRule ^/Zope/(.*) /usr/local/httpd/cgi-bin/Zope.cgi/$1 [e=HTTP_CGI_AUTHORIZATION:%1,t=application/x-httpd-cgi,l] (Zope is installed under /root/zope/rel2.1/Zope-2.1.0b2-src, Apache under /usr/local/httpd) I would appreciate your Help and answer to ma.s+c(a)bmw.de (temporariliy adress since our router is out of order, so this adress is not in the list) thanks Micha -i have tried to strace apache Process: it calls pcgi... and Zope .cgi but i never see a stat on the file access,but since changes in access are only registered after restart i asume that access is read in memory not in file) Here i have my apache configured to log the rewrite --the log from the rewrite looks for me starnge (passed through ?) bash-2.03# more zap_rewrite_log 127.0.0.1 - - [22/Nov/1999:13:30:11 +0100] [lap2.m.science-computing.de/sid#8083444][rid#80b6674/initial] (1) pass through /cg i-bin/Zope.cgi/manage 127.0.0.1 - - [22/Nov/1999:13:30:11 +0100] [lap2.m.science-computing.de/sid#8083444][rid#80bca7c/subreq] (1) pass through /man age 127.0.0.1 - - [22/Nov/1999:13:31:11 +0100] [lap2.m.science-computing.de/sid#8083444][rid#80b6674/initial] (1) pass through /cg i-bin/Zope.cgi/manage 127.0.0.1 - - [22/Nov/1999:13:31:11 +0100] [lap2.m.science-computing.de/sid#8083444][rid#80bca7c/subreq] (1) pass through /man age 127.0.0.1 - - [22/Nov/1999:13:31:20 +0100] [lap2.m.science-computing.de/sid#8083444][rid#80b6674/initial] (1) pass through /cg i-bin/Zope.cgi/manage 127.0.0.1 - - [22/Nov/1999:13:31:20 +0100] [lap2.m.science-computing.de/sid#8083444][rid#80bca7c/subreq] (1) pass through /man age 127.0.0.1 - - [22/Nov/1999:13:31:26 +0100] [lap2.m.science-computing.de/sid#8083444][rid#80b6674/initial] (1) pass through /cg i-bin/Zope.cgi/manage 127.0.0.1 - - [22/Nov/1999:13:31:26 +0100] [lap2.m.science-computing.de/sid#8083444][rid#80bca7c/subreq] (1) pass through /man age 127.0.0.1 - - [22/Nov/1999:13:40:00 +0100] [lap2.m.science-computing.de/sid#8083444][rid#80b6674/initial] (1) pass through /cg i-bin/Zope.cgi/manage 127.0.0.1 - - [22/Nov/1999:13:40:00 +0100] [lap2.m.science-computing.de/sid#8083444][rid#80bca7c/subreq] (1) pass through /man age 127.0.0.1 - - [22/Nov/1999:13:40:04 +0100] [lap2.m.science-computing.de/sid#8083444][rid#80b6674/initial] (1) pass through /cg i-bin/Zope.cgi/manage --more bits--- I had a look at zap, but when thsi starts up (i have modified usr to a user which exists on my insatllation it tries to start with a very strange gid and bails out. I have not found where this gid stems from. I have compared zag and my httpd.con and see no diff ...

1 0

Re: [Zope] SQLSession help needed!
by Anthony Baxter 21 Nov '99

21 Nov '99

>>> Farzad Farid wrote > On Sat, Nov 20, 1999, root wrote: > > I did get my SQLSession installed. Thank you Harry. However, I am > > having trouble getting the SESSION.set(...) to work. > > Here is the code I am using. > > > > [...] > > <dtml-var "SESSION.set('myZipCode', ZipCode)"> > > <dtml-var "SESSION.set('myDistance', Distance)"> > > The README says <dtml-call ..> not <dtml-var ..>, isn't that your problem? I fixed the readme for 0.2.0 - it previously did say to use dtml-var, which was an error. Sorry for the confusion. Anthony -- Anthony Baxter <anthony(a)interlink.com.au> It's never too late to have a happy childhood.

1 0