- Zope - Zope lists

RE: [Zope] new proposal with Verisign CA (was radius authenticati on instead of flatfile or userdb?) flatfile or userdb?)
by Rob Page 10 Sep '99

10 Sep '99

Anthony Baxter wrote: <snip> > It should work against any particular LDAP server - if it > doesn't, then > we have a standards incompatibility problem. > > One thing I wasn't entirely sure on, last time I looked at this - is the > username/password type schema properly standardised? Jeffrey added a clever option to the LDAPUserFolder which lets you map arbitrary LDAP attributes into the username and password fields. In our case, (iirc) the inetOrgPerson has a userid and password field in the standard object schema. > > > I think this is HARD. If your use of "authorizer signature" means a > > digital signature of the requisition, you're in for some > pain. Zope has > > no organic crypto (save the nifty hashed password stuff). > Getting and > > talking to an X509 cert will be some work. > > But a client-side cert acl_users would be way, way cool. I agree!!! > > Yes and no. Certainly redhat's secure server and stronghold can use > > Verisign certs. However, I'd bet a nickel that all they would do by > > default is pass a securely bound Distinguished Name (DN) to the Zope > > proces. You're not likely (although I could easily be wrong) to get > > any of the crypto stuff (e.g., public key). > > Yeah, you may be able to get stronghold, or something, to do the client-side > certificate auth. Hey, didn't Chris Petrilli work with this stuff? Yep. We've now got the expertise, we've just not had the opportunity to get into it. The customer driving our LDAP work will, in the next 3-4 months, also be driving an x509 requirement. When we do get to it I _strongly_ suspect that we'll defer as much as possible to the web server (in their case Netscape ES). --Rob

1 0

RE: [Zope] Login?
by Rob Page 10 Sep '99

10 Sep '99

> I am planning to create a registration product that will > validate new users > against an LDAP directory. > i.e. > The user fills out the registration form. > Zope verifies that the user exists in the directory. > If the lookup succeeds > Zope creates a user login and lets the user > know that his > registration is suceeded. > else > Zope sends e-mail to the administrator and > tells the user > who that administrator is. > > > If anyone has done this already, or is doing this, I will > work with you. > Otherwise, I will probably get around to this in about two weeks. Please share a few more details. I don't quote follow what you're trying to do. We are in beta with an consulting application that makes HEAVY use of LDAP. It derives from: (a) Anthony Baxter's LDAP work, (b) recent work by CodeIt Computing on LDAPUserFolders and, (c) a lot of integration/polish/implementation by Jeffrey Shell here at DC. (a) and (b) are available on the zope (new?) web site. We plan to make the fruits of (c) generally available once we've had a moment or two to bake into a final form and document it. --Rob

3 2

RE: [Zope] two things at once
by Rob Page 10 Sep '99

10 Sep '99

> I want to modify two frames at once <snip> > do I have to go into JScript to do this or is there some neat > way to do > it? Could you make the target of the href from B the parent frameset? IOW, rewrite the entire page. How you would get a link from B to send the B1 page, I'm not sure. Somehow, you would have to know that the "top" content for B was B1 (as opposed to B2)... --Rob

2 1

RE: [Zope] new proposal with Verisign CA (was radius authenticati on instead of flatfile or userdb?) flatfile or userdb?)
by Rob Page 10 Sep '99

10 Sep '99

> New project ideas: > > 1) create web request forms > a)primary page requests userid (everyone has a userid) > b)look up userid in Netscape LDAP database (Does LDAP adapter work > with Netscape LDAP?) The LDAP specification defines the API. Recent visual inspection strongly suggests that the LDAP Adapter (i.e., the underlying Python extension) can use the Netsape LDAP libraries. However, I tried this very, very briefly. Unfortunately, Netscape packages their LDAP libraries in a TOTALLY different way then the OpenLDAP project. I spent 3.5 seconds tinkering with the makefile and gave up. Of couse, the LDAP adapter works with both OpenLDAP and Netscape Directory Server LDAP servers. > c)display user information - give options for request forms > d)user chooses and fills out request form > > 2) create methods to operate on data in request form > a)move request form information to database (is it better to stay in > zope or move to sql database?) > b)notify authorizers they have forms to authorize > c)authorizer logs into zope with certificate from Verisign (does > anyone know if apache/stronghold or other will work with Verisign CA?) > d)authorizer is presented with a queue of forms to authorize > e)authorizer signature/certificate is stored along with > form data for > proof of authorization (again, is it better to stay in zope with this > information or move to sql. This information will be very > critical and > should be stored in the safest location with regular backups.) I think this is HARD. If your use of "authorizer signature" means a digital signature of the requisition, you're in for some pain. Zope has no organic crypto (save the nifty hashed password stuff). Getting and talking to an X509 cert will be some work. > Since I am not a Python programmer, how hard will this be to > accomplish? uh, pretty hard. > Can it be accomplished without Python - just dtml and some Zclasses? uh, nope. > Roughly, how long will this possibly take (I will be learning all the > new Zope 2 stuff along the way. Zope 1 stuff is not too > difficult.) if > this is the only project that I am coding? Learn python, learn ssleay, believe that crypto is your friend, etc., etc.. if you've got to learn this first, it might be a looong project. > Would these assumptions work - use apache/stronghold for certificate > stuff and pass this through to zope for login; use portal toolkit to > present authorization queue to authorizer when he logs in to zope? Yes and no. Certainly redhat's secure server and stronghold can use Verisign certs. However, I'd bet a nickel that all they would do by default is pass a securely bound Distinguished Name (DN) to the Zope process. You're not likely (although I could easily be wrong) to get any of the crypto stuff (e.g., public key). > I have not looked at portal toolkit. How are users stored? In the Zope ODB as member objects. > If possible, how would I keep the zope root user from authorizing > someone's queue or forms? This would be tough as it would require you to tackle all of the nasty two-key crypto stuff. Could you put the server in a locked room with armed guards? :^) --Rob

1 0

RE: [Zope] how do I publish my site
by Rob Page 10 Sep '99

10 Sep '99

> Currently I have a domain foo. I work on footest and when I am > satisfied I > create a copy of footest and then rename copy_of_footest to > foo. I then > continue to work on foo. IS this the way to move a site from test to > production > or is there a 'Zope' way to do it This is one viable way. Another way might be to work in a Version and make the Version live periodically... --Rob

1 0

two things at once
by Robin Becker 10 Sep '99

10 Sep '99

I want to modify two frames at once ie in my side bar I have some links sidebar | Body A | page A B | C | I would like link B to modify the side bar and at the same time move the main body frame to a new location B1 ie sidebar | Body A | page B1 B | B1 | B2 | B3 | C | do I have to go into JScript to do this or is there some neat way to do it? -- Robin Becker

3 2

RE: [Zope] ftp-upload
by Rob Page 10 Sep '99

10 Sep '99

> what about zope2. do i still have to use an extension, or is > ftp now a zope > feature? if yes: how do i do it? If you're using a stock Zope 2 ftp to port 8021. Note that ftp support does not include all object types (e.g., ZSQL Methods are not supported). --Rob

1 0

Q: calendar tag
by Oliver Dissars 10 Sep '99

10 Sep '99

Hi, I found the calendar tag on the Zope Site and it seems to be an powerful ext. to zope. The basics are clear, f.e.:  <dtml-var date fmt=day> <dtml-var TestText>  But I don't managed to figure out how to insert data into day cells. Has anybody an example how to use this tag? Regards, Oliver Dissars

2 1

ZCatalog, SQL database and PDF files
by Kam Cheung 10 Sep '99

10 Sep '99

I just installed Zope2, and it's so great. ZCatalog almost does what I need to do in my current project. However, there's one thing that it couldn't do (or at least I don't know how it can be done) -- can ZCatalog be used to search a SQL database in addition to other objects in the Zope ODB? How about external files like PDF file? Python, SQL, Zope and even programming in general are all very new to me (I am a designer, not a programmer), so if someone knows how it can be done, please explain it in an easy to understand way (examples are the best!!!) Kam On Cheung

2 1

Re: Some questions about ZCatalog
by Itai Tavor 10 Sep '99

10 Sep '99

Just thought of a possible solution to the last problem... add a method to the object, named title_of_parent, which returns the parent's title. Tell the catalog to index title_of_parent. Take a vacation. Makes sense? Good solution? Comments? Itai Tavor wrote: > Hi, > > I can't figure out how to access an object found by a catalog search: > > <dtml-let obj="Catalog.getobject(data_record_id_, REQUEST)"> &dtml-obj; > </dtml-let> > > displays the object instance ( <DTMLDocument instance at xxxxxxx> ). > But: > > <dtml-with "Catalog.getobject(data_record_id_, REQUEST)"> &dtml-title; > </dtml-with> > > returns Unahthorized. Why? > > A related question: Instead of accessing the object, like I try to do > above, I guess I can plug in a brain that will get whatever I need from > the object and add it to the data record. Is there a simple example > anywhere of how to implement a simple pluggabale brain for a catalog > that will do this? > > And one more question: The reason I need to do all this is that my find > page needs to show the titles of the containers of the found object, two > levels up. I can't index these titles in the catalog, because indexing > 'title' gets the title of the object, and the catalog can't be told to > index "PARENTS[1].title" (or can it?). Is it possible somehow for a > catalog aware object to add properties to its entry in the catalog? > > BTW, my catalog aware objects are Python products, not ZClasses, if that > makes a difference. > > Thanks Itai -- Itai Tavor -- "Je sautille, donc je suis." -- itavor(a)vic.bigpond.net.au -- - Kermit the Frog -- -- 'Supposing a tree fell down, Pooh, when we were underneath it?' -- -- 'Supposing it didn't,' said Pooh after careful thought. --

2 1