- Zope - Zope lists

RE: [Zope] permission and role questions
by Rob Page 15 Apr '99

15 Apr '99

Keith: I can answer some of the more basic questions -- you ask some toughies so I'm hopeful others can add some insight. > 1) How does one examine the logged-in user's username from > DTML? I think I > just need the variable name here...  > 2) Once I know the user ID, how can I get a list of places > the user is > permitted, so that all users can enter via one "front door" > that always > shows exactly those rooms the user may enter? We use this rhythm a LOT! <UL> <LI><A HREF="PublicRoom">Public Room</A></LI>  <LI><A HREF="Room1">Room 1</A></LI>   <LI><A HREF="Room2">Room 2</A></LI>  </UL> Of course, the Room1 and Room2 folders should have the appropriate permission set -- this only controls the UI. > 3) Is there any form of permission inheritance or > impersonation implemented? > Our application interfaces with other systems, and maps some > local user IDs > to remote user IDs. Assistants log in with their own IDs, > then pick a > "primary" user on whose behalf to work; the system then uses > the "primary" > user's permissions and presents the "primary" user's remote > credentials. > I'm thinking I'll have to do this myself, since I need to > keep both IDs > around for auditing info...fortunately I'm already expecting > to use a custom > authentication layer (ever try to time out a session with basic > authentication?). Zope is architected specifically to allow a modular authentication scheme -- you should check out UserDB at: http://www.zope.org/Download/Prereleases/UserDB While officially unsupported, it allows you to go to a relational database for authentication. Of course, the underlying SQLMethods are exposed so you could "go to town" on customizing your auth policies. In the database you could actually store a attribute of each user with is their external system id (e.g., external_sys1_id and external_sys1_password), retrieve this w/a SQLMethod and send it off to the other external system for authentication. > 4) The security screen's permission settings have "acquire" > checkboxes, > whose point is obvious, and per-role checkboxes. I take it > those enable > permissions? So we can allow inherited permissions, and we > can explicitly > add permissions, but there's no way to add-only-if-inherited or > inherit-but-deny-particular-loons-anyway? Also, the permissions on > intervening levels of the tree are not checked, only > inherited, right? bubububub.... Don't have an answer for this one -- this needs a higher Zen level - maybe someone else can answer this? > 5) If I define users at a high level, can I grant those > users roles defined > at deeper levels? This would make my job with point (2) > much easier, as I > could create roles Foobar_Peon and Foobar_Boss in the Foobar > folder, then > offer the user buttons into Foobar if they have > Foobar_whatever roles... Hmmm.. I don't think this will work. Why do you want to avoid defining the roles at the top of the Zope hierarchy? IOW, if you define the folders at the top you could still restrict access to subordnate folders per those role definitions. > 6) Is there any plan for, or how hard would it be to > implement, a "reverse" > permission manipulation screen where the role is fixed and > the subsystems > are columns? How would you define a subsystem? > I'm largely looking at Zope and ACE--and may wind up using them in > conjunction somehow--to recommend as frameworks; ACE (plus > TAO) has good RPC > and OS abstraction layers for C++, while Zope is a much > richer framework for > web applications. If I have to write in permission checking > and proxy users > along with the audit trail and the actual application > functionality, no > biggie... > > Keith (I may need to inhale the developer docs now...) Yep! --Rob

1 0

Direct SQL
by Shaw, Howard 15 Apr '99

15 Apr '99

When using direct traversal on SQL methods, the preferred form is /SQLmethod/value/htmlpage. Since I want users to not have to know what html page they are supposed to reference, I have my index.htm set up to react to the presence of trigger keys in the url by including different files.        I would like to know whether there is anyway in DTML to determine whether variables in the namespace result from an SQL method. Specifically, I want a test which answers the question "Has SQL Method X been called prior to evaluation of this page?" I need this because at the moment, if someone uses a URL with 'department' or 'staff' and fails to include the trailing /, they get a Zope error. I would prefer if it simply displayed the index.htm contents. Thanks, Howard C. Shaw III Programmer/SysAdmin St. Thomas High School

1 0

RE: [Zope] = replaced with == in sendmail!!!!!
by Michel Pelletier 15 Apr '99

15 Apr '99

> -----Original Message----- > From: Jay, Dylan [mailto:djay@lucent.com] > Sent: Wednesday, April 14, 1999 11:39 PM > To: 'zope(a)zope.org' > Subject: [Zope] = replaced with == in sendmail!!!!! > > > I have the following inside a sendmail tag > > /completeReg?MagicNumber= > > However in the mail that is sent this comes out as > > http://blah.com/completeReg?MagicNumber==23423434 > > This is incredibly fustrating and I can find no way around this. Even > > /completeReg?MagicNumber > > produces the same result. Whats going on? > I have no idea, but try:  just for the heck of it and tell us what happens. -Michel > _______________________________________________ > Zope maillist - Zope(a)zope.org > http://www.zope.org/mailman/listinfo/zope > > (For developer-specific issues, use the companion list, > zope-dev(a)zope.org - http://www.zope.org/mailman/listinfo/zope-dev ) >

1 0

RE: [Zope] Has anyone tried to make Zope invisible using IIS
by Brian Lloyd 15 Apr '99

15 Apr '99

> I basically want to make a virtual directory that points to > everything on > the other side of the PCGI exe file however stupid IIS seems > to be only able > to make a real directory a virtual directory. Has anyone > found a way around > that? Isn't IIS great? :^) I spent some time looking into this about a year ago, and found that the only way to do this (at least at that time) was to write an IIS filter dll in C. I imagine that look on your face right now about matches the one on mine when I came to this conclusion... :) I've attached a .zip file containing the msvc++ project and sources for a _very_ minimal, hard-coded url alias filter - it worked with IIS3, but I can make no guarantees about IIS4+. There's no documentation for it (though the code is quite tiny) and it's _totally_ unsupported, so you'll have to look to MS' IIS extension/filter documentation for details on how to get it installed, built, what it's doing, etc. Hopefully it's a start though. I'm sure that the Zope community would love to see a more flexible version of it though, if you'd care to fix it up :^) Hope this helps! Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

1 0

= replaced with == in sendmail!!!!!
by Jay, Dylan 15 Apr '99

15 Apr '99

I have the following inside a sendmail tag /completeReg?MagicNumber= However in the mail that is sent this comes out as http://blah.com/completeReg?MagicNumber==23423434 This is incredibly fustrating and I can find no way around this. Even /completeReg?MagicNumber produces the same result. Whats going on?

1 0

ZServer problems
by Jim Bickford 15 Apr '99

15 Apr '99

Hi all... I've been lurking on the list for a few months and slowly coming to grips with some Zope zen. I am trying to migrate the school site across from a static one to Zope. I have no trouble running ZHttpServer or Zap but I'd like to use FTP but there's the rub. After sorting out all the initial Red Hat 5.2 problems with help from Amos et al ZServer accepts http connections fine but no matter what I try I can't use ftp.... In the current set-up on my home P133 Zope-1.10.2 is set-up and running as user: Zope [/home/Zope]$ ftp localhost 8021 (or any other user) Connected to localhost (hang) Any help much appreciated... Cheers JimB ZServer dumps: log: adding channel <trigger at 81188c8> log: adding channel <http_server at 81a2a68> Warning: computing default hostname Medusa (V1.4) started at Thu Apr 15 08:22:15 1999 Hostname: fritz.homenet.net.au Port:9673 log: adding channel <FTPServer at 80ae468> FTP server started at Thu Apr 15 08:22:15 1999 Authorizer:None Hostname: localhost Port: 8021 log: adding channel <PCGIServer at 81a47c0> Incoming connection from 127.0.0.1:1028 uncaptured python exception, closing channel <FTPServer listening :8021 at 80ae468> (socket.error:(111, 'Connection refused') [ZServer/medusa/asyncore.py|poll|61] [ZServer/medusa/asyncore.py|handle_read_event|291] [ZServer/ZServerFTP.py|handle_accept|714] [ZServer/ZServerFTP.py|__init__|178] [ZServer/medusa/ftp_server.py|__init__|96] [ZServer/medusa/ftp_server.py|respond|241] [ZServer/medusa/ftp_server.py|log|233] [ZServer/medusa/logger.py|log|160] [ZServer/medusa/resolver.py|resolve_ptr|321] [ZServer/medusa/resolver.py|resolve_ptr|231]) log: closing channel 11:<FTPServer listening :8021 at 80ae468> log: adding channel <trigger at 8118860> log: adding channel <http_server at 81a2a20> Warning: computing default hostname Medusa (V1.4) started at Thu Apr 15 08:34:36 1999 Hostname: fritz.homenet.net.au Port:9673 log: adding channel <FTPServer at 80ae468> FTP server started at Thu Apr 15 08:34:36 1999 Authorizer:None Hostname: localhost Port: 8021 log: adding channel <PCGIServer at 81a4770> Incoming connection from 127.0.0.1:1029 uncaptured python exception, closing channel <FTPServer listening :8021 at 80ae468> (socket.error:(111, 'Connection refused') [ZServer/medusa/asyncore.py|poll|61] [ZServer/medusa/asyncore.py|handle_read_event|291] [ZServer/ZServerFTP.py|handle_accept|714] [ZServer/ZServerFTP.py|__init__|178] [ZServer/medusa/ftp_server.py|__init__|96] [ZServer/medusa/ftp_server.py|respond|241] [ZServer/medusa/ftp_server.py|log|233] [ZServer/medusa/logger.py|log|160] [ZServer/medusa/resolver.py|resolve_ptr|321] [ZServer/medusa/resolver.py|resolve_ptr|231]) log: closing channel 11:<FTPServer listening :8021 at 80ae468> log: adding channel <trigger at 81188c8> log: adding channel <http_server at 81a2a38> Warning: computing default hostname Medusa (V1.4) started at Thu Apr 15 08:36:40 1999 Hostname: fritz.homenet.net.au Port:9673 log: adding channel <FTPServer at 80ae468> FTP server started at Thu Apr 15 08:36:40 1999 Authorizer:None Hostname: localhost Port: 8021 log: adding channel <PCGIServer at 81a4798> Incoming connection from 127.0.0.1:1048 uncaptured python exception, closing channel <FTPServer listening :8021 at 80ae468> (socket.error:(111, 'Connection refused') [ZServer/medusa/asyncore.py|poll|61] [ZServer/medusa/asyncore.py|handle_read_event|291] [ZServer/ZServerFTP.py|handle_accept|714] [ZServer/ZServerFTP.py|__init__|178] [ZServer/medusa/ftp_server.py|__init__|96] [ZServer/medusa/ftp_server.py|respond|241] [ZServer/medusa/ftp_server.py|log|233] [ZServer/medusa/logger.py|log|160] [ZServer/medusa/resolver.py|resolve_ptr|321] [ZServer/medusa/resolver.py|resolve_ptr|231]) log: closing channel 11:<FTPServer listening :8021 at 80ae468> -- --------------------------------------------------------------------- Jim.Bickford(a)flinders.edu.au Biological Sci Flinders University 61 8 8201 3179(v) 61 8 8201 3015(f) South Australia 5042 ---------------------------------------------------------------------

1 0

Has anyone tried to make Zope invisible using IIS
by Jay, Dylan 15 Apr '99

15 Apr '99

I basically want to make a virtual directory that points to everything on the other side of the PCGI exe file however stupid IIS seems to be only able to make a real directory a virtual directory. Has anyone found a way around that?

1 0

permission and role questions
by Keith Rohrer 15 Apr '99

15 Apr '99

I'm working on designing a web application, and right now I'm particularly scrutinizing Zope's permission model. In trying to think how I'd use it to do what our existing, highly custom system does today, I wonder: 1) How does one examine the logged-in user's username from DTML? I think I just need the variable name here... 2) Once I know the user ID, how can I get a list of places the user is permitted, so that all users can enter via one "front door" that always shows exactly those rooms the user may enter? 3) Is there any form of permission inheritance or impersonation implemented? Our application interfaces with other systems, and maps some local user IDs to remote user IDs. Assistants log in with their own IDs, then pick a "primary" user on whose behalf to work; the system then uses the "primary" user's permissions and presents the "primary" user's remote credentials. I'm thinking I'll have to do this myself, since I need to keep both IDs around for auditing info...fortunately I'm already expecting to use a custom authentication layer (ever try to time out a session with basic authentication?). 4) The security screen's permission settings have "acquire" checkboxes, whose point is obvious, and per-role checkboxes. I take it those enable permissions? So we can allow inherited permissions, and we can explicitly add permissions, but there's no way to add-only-if-inherited or inherit-but-deny-particular-loons-anyway? Also, the permissions on intervening levels of the tree are not checked, only inherited, right? 5) If I define users at a high level, can I grant those users roles defined at deeper levels? This would make my job with point (2) much easier, as I could create roles Foobar_Peon and Foobar_Boss in the Foobar folder, then offer the user buttons into Foobar if they have Foobar_whatever roles... 6) Is there any plan for, or how hard would it be to implement, a "reverse" permission manipulation screen where the role is fixed and the subsystems are columns? I'm largely looking at Zope and ACE--and may wind up using them in conjunction somehow--to recommend as frameworks; ACE (plus TAO) has good RPC and OS abstraction layers for C++, while Zope is a much richer framework for web applications. If I have to write in permission checking and proxy users along with the audit trail and the actual application functionality, no biggie... Keith (I may need to inhale the developer docs now...)

1 0

RE: [Zope] Is someone using Zope in Europe : A new buggy platform/os : linux alpha 5.1???
by Gilles.Lavaux 14 Apr '99

14 Apr '99

Rik Hoekstra wrote: > I know, it is WinNT/95. There There is not much to be done about it .... Hello. No, it's not Windows something: I run Zope on a Dec Alpha Miata + Linux Red-Hat 5.1 + python 1.51. I use a PostgreSQL DB and every SQL date parsing works great. I have discovered this timezone pb. with the calendar tag. If someone has successfully patched the DateTime module (or something else) on this platform, please mail me. I have also a red-hat 5.2 alpha box. So I guess I will have to try it. Thanks for the article reference. Gilles

1 0

Is someone using Zope in Europe?
by Gilles.Lavaux 14 Apr '99

14 Apr '99

if yes, please contact me. I want to know which timezone you get from Zope. I get a blank/empty one and it give me problem. Gilles.lavaux(a)esrin.esa.it Ps:je me rappelle avoir vu quelqu'un de Suisse...

2 1