- Zope - Zope lists

RE: [Zope] permission and role questions
by Michel Pelletier 15 Apr '99

15 Apr '99

> -----Original Message----- > From: Keith Rohrer [mailto:KRohrer@hnv.com] > Sent: Wednesday, April 14, 1999 8:05 PM > To: 'Zope Users List' > Subject: [Zope] permission and role questions > > > I'm working on designing a web application, and right now I'm > particularly > scrutinizing Zope's permission model. In trying to think how > I'd use it to > do what our existing, highly custom system does today, I wonder: > > 1) How does one examine the logged-in user's username from > DTML? I think I > just need the variable name here...  AUTHENTICATED_USER is a user object returned by the acl_users object. In the case of a regular Zope User Folder, an etcUserFolder, or a UserDb folder, the AUTHENTICATED_USER object is a AccessControl.User.BasicUser instance. In the case of an IMAPAdapter object, it is an IMAPUser instance. The above var tag will render the user name of AUTHENTICATED_USER. > > 2) Once I know the user ID, how can I get a list of places the user is > permitted, so that all users can enter via one "front door" > that always > shows exactly those rooms the user may enter? > User have Roles. Roles are abastractions like Manager, SalesGuy, IMAPUser, or whatever else you want to call a Role. Object and methods in Zope have certain permissions. You can turn on or off certain permissions for certain Roles on individual objects and methods in Zope. Exactly how this access control model works is detailed in the Zope Managers Guide starting around page 17. > 3) Is there any form of permission inheritance or > impersonation implemented? > Our application interfaces with other systems, and maps some > local user IDs > to remote user IDs. Assistants log in with their own IDs, then pick a > "primary" user on whose behalf to work; the system then uses > the "primary" > user's permissions and presents the "primary" user's remote > credentials. > I'm thinking I'll have to do this myself, since I need to > keep both IDs > around for auditing info...fortunately I'm already expecting > to use a custom > authentication layer (ever try to time out a session with basic > authentication?). Objects can acquire permissions from the objects that contain them. If you set a certain flavor of access control on a folder, you can specify that you want the contents of that folder to acquire their parent's permission settings. 'Acquire Permisssions' is the default on all permissions. > > 4) The security screen's permission settings have "acquire" > checkboxes, > whose point is obvious, and per-role checkboxes. I take it > those enable > permissions? So we can allow inherited permissions, and we > can explicitly > add permissions, but there's no way to add-only-if-inherited or > inherit-but-deny-particular-loons-anyway? Also, the permissions on > intervening levels of the tree are not checked, only inherited, right? 'Acquisition' isn't a name we use to mean 'Inheritance', Acquisition is actualy a complimentary mechanism to inheritance. There are several good documents on it here (http://www.zope.org/Documentation/Reference) and this morning I released some rough draft documentation that included some acquisition stuf on the the zdp list (http://www.zope.org/mailman/listinfo/zdp) By checking the acquire box in the security tab, you are telling that object to accept the same permission settings as the parent that contains it. The parent may also be acquiring from *its* parent, and so on, till it reaches the root folder. At each step in the object heirarchy, you are given the ability to make security restrictions less general and more specific to your application. > > 5) If I define users at a high level, can I grant those users > roles defined > at deeper levels? This would make my job with point (2) much > easier, as I > could create roles Foobar_Peon and Foobar_Boss in the Foobar > folder, then > offer the user buttons into Foobar if they have > Foobar_whatever roles... Users 'at higher levels' cannot be given Roles defined below them, but this behavior is easy to emulate with the system, just give them a higher level role that is the superset (contains all of) the permissions that the role you want them to be lower has. Users have Roles, and Roles are collections of permissions. You can have a Role which allows many permissions defined higher up, and the more specialized you get (farther down) you can create more restricted roles that are subset (contain a portion of) the higher level role. > > 6) Is there any plan for, or how hard would it be to > implement, a "reverse" > permission manipulation screen where the role is fixed and > the subsystems > are columns? > I'm not sure why you would want to do this. I'm guessing it's possible and cleaner to do whatever you have in mind with the current method. -Michel > > I'm largely looking at Zope and ACE--and may wind up using them in > conjunction somehow--to recommend as frameworks; ACE (plus > TAO) has good RPC > and OS abstraction layers for C++, while Zope is a much > richer framework for > web applications. If I have to write in permission checking > and proxy users > along with the audit trail and the actual application > functionality, no > biggie... > > Keith (I may need to inhale the developer docs now...) > > _______________________________________________ > Zope maillist - Zope(a)zope.org > http://www.zope.org/mailman/listinfo/zope > > (For developer-specific issues, use the companion list, > zope-dev(a)zope.org - http://www.zope.org/mailman/listinfo/zope-dev ) >

1 0

RE: [Zope] permission and role questions
by Rob Page 15 Apr '99

15 Apr '99

Keith: I can answer some of the more basic questions -- you ask some toughies so I'm hopeful others can add some insight. > 1) How does one examine the logged-in user's username from > DTML? I think I > just need the variable name here...  > 2) Once I know the user ID, how can I get a list of places > the user is > permitted, so that all users can enter via one "front door" > that always > shows exactly those rooms the user may enter? We use this rhythm a LOT! <UL> <LI><A HREF="PublicRoom">Public Room</A></LI>  <LI><A HREF="Room1">Room 1</A></LI>   <LI><A HREF="Room2">Room 2</A></LI>  </UL> Of course, the Room1 and Room2 folders should have the appropriate permission set -- this only controls the UI. > 3) Is there any form of permission inheritance or > impersonation implemented? > Our application interfaces with other systems, and maps some > local user IDs > to remote user IDs. Assistants log in with their own IDs, > then pick a > "primary" user on whose behalf to work; the system then uses > the "primary" > user's permissions and presents the "primary" user's remote > credentials. > I'm thinking I'll have to do this myself, since I need to > keep both IDs > around for auditing info...fortunately I'm already expecting > to use a custom > authentication layer (ever try to time out a session with basic > authentication?). Zope is architected specifically to allow a modular authentication scheme -- you should check out UserDB at: http://www.zope.org/Download/Prereleases/UserDB While officially unsupported, it allows you to go to a relational database for authentication. Of course, the underlying SQLMethods are exposed so you could "go to town" on customizing your auth policies. In the database you could actually store a attribute of each user with is their external system id (e.g., external_sys1_id and external_sys1_password), retrieve this w/a SQLMethod and send it off to the other external system for authentication. > 4) The security screen's permission settings have "acquire" > checkboxes, > whose point is obvious, and per-role checkboxes. I take it > those enable > permissions? So we can allow inherited permissions, and we > can explicitly > add permissions, but there's no way to add-only-if-inherited or > inherit-but-deny-particular-loons-anyway? Also, the permissions on > intervening levels of the tree are not checked, only > inherited, right? bubububub.... Don't have an answer for this one -- this needs a higher Zen level - maybe someone else can answer this? > 5) If I define users at a high level, can I grant those > users roles defined > at deeper levels? This would make my job with point (2) > much easier, as I > could create roles Foobar_Peon and Foobar_Boss in the Foobar > folder, then > offer the user buttons into Foobar if they have > Foobar_whatever roles... Hmmm.. I don't think this will work. Why do you want to avoid defining the roles at the top of the Zope hierarchy? IOW, if you define the folders at the top you could still restrict access to subordnate folders per those role definitions. > 6) Is there any plan for, or how hard would it be to > implement, a "reverse" > permission manipulation screen where the role is fixed and > the subsystems > are columns? How would you define a subsystem? > I'm largely looking at Zope and ACE--and may wind up using them in > conjunction somehow--to recommend as frameworks; ACE (plus > TAO) has good RPC > and OS abstraction layers for C++, while Zope is a much > richer framework for > web applications. If I have to write in permission checking > and proxy users > along with the audit trail and the actual application > functionality, no > biggie... > > Keith (I may need to inhale the developer docs now...) Yep! --Rob

1 0

Direct SQL
by Shaw, Howard 15 Apr '99

15 Apr '99

When using direct traversal on SQL methods, the preferred form is /SQLmethod/value/htmlpage. Since I want users to not have to know what html page they are supposed to reference, I have my index.htm set up to react to the presence of trigger keys in the url by including different files.        I would like to know whether there is anyway in DTML to determine whether variables in the namespace result from an SQL method. Specifically, I want a test which answers the question "Has SQL Method X been called prior to evaluation of this page?" I need this because at the moment, if someone uses a URL with 'department' or 'staff' and fails to include the trailing /, they get a Zope error. I would prefer if it simply displayed the index.htm contents. Thanks, Howard C. Shaw III Programmer/SysAdmin St. Thomas High School

1 0

RE: [Zope] = replaced with == in sendmail!!!!!
by Michel Pelletier 15 Apr '99

15 Apr '99

> -----Original Message----- > From: Jay, Dylan [mailto:djay@lucent.com] > Sent: Wednesday, April 14, 1999 11:39 PM > To: 'zope(a)zope.org' > Subject: [Zope] = replaced with == in sendmail!!!!! > > > I have the following inside a sendmail tag > > /completeReg?MagicNumber= > > However in the mail that is sent this comes out as > > http://blah.com/completeReg?MagicNumber==23423434 > > This is incredibly fustrating and I can find no way around this. Even > > /completeReg?MagicNumber > > produces the same result. Whats going on? > I have no idea, but try:  just for the heck of it and tell us what happens. -Michel > _______________________________________________ > Zope maillist - Zope(a)zope.org > http://www.zope.org/mailman/listinfo/zope > > (For developer-specific issues, use the companion list, > zope-dev(a)zope.org - http://www.zope.org/mailman/listinfo/zope-dev ) >

1 0

RE: [Zope] Has anyone tried to make Zope invisible using IIS
by Brian Lloyd 15 Apr '99

15 Apr '99

> I basically want to make a virtual directory that points to > everything on > the other side of the PCGI exe file however stupid IIS seems > to be only able > to make a real directory a virtual directory. Has anyone > found a way around > that? Isn't IIS great? :^) I spent some time looking into this about a year ago, and found that the only way to do this (at least at that time) was to write an IIS filter dll in C. I imagine that look on your face right now about matches the one on mine when I came to this conclusion... :) I've attached a .zip file containing the msvc++ project and sources for a _very_ minimal, hard-coded url alias filter - it worked with IIS3, but I can make no guarantees about IIS4+. There's no documentation for it (though the code is quite tiny) and it's _totally_ unsupported, so you'll have to look to MS' IIS extension/filter documentation for details on how to get it installed, built, what it's doing, etc. Hopefully it's a start though. I'm sure that the Zope community would love to see a more flexible version of it though, if you'd care to fix it up :^) Hope this helps! Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

1 0

= replaced with == in sendmail!!!!!
by Jay, Dylan 15 Apr '99

15 Apr '99

I have the following inside a sendmail tag /completeReg?MagicNumber= However in the mail that is sent this comes out as http://blah.com/completeReg?MagicNumber==23423434 This is incredibly fustrating and I can find no way around this. Even /completeReg?MagicNumber produces the same result. Whats going on?

1 0

ZServer problems
by Jim Bickford 15 Apr '99

15 Apr '99

Hi all... I've been lurking on the list for a few months and slowly coming to grips with some Zope zen. I am trying to migrate the school site across from a static one to Zope. I have no trouble running ZHttpServer or Zap but I'd like to use FTP but there's the rub. After sorting out all the initial Red Hat 5.2 problems with help from Amos et al ZServer accepts http connections fine but no matter what I try I can't use ftp.... In the current set-up on my home P133 Zope-1.10.2 is set-up and running as user: Zope [/home/Zope]$ ftp localhost 8021 (or any other user) Connected to localhost (hang) Any help much appreciated... Cheers JimB ZServer dumps: log: adding channel <trigger at 81188c8> log: adding channel <http_server at 81a2a68> Warning: computing default hostname Medusa (V1.4) started at Thu Apr 15 08:22:15 1999 Hostname: fritz.homenet.net.au Port:9673 log: adding channel <FTPServer at 80ae468> FTP server started at Thu Apr 15 08:22:15 1999 Authorizer:None Hostname: localhost Port: 8021 log: adding channel <PCGIServer at 81a47c0> Incoming connection from 127.0.0.1:1028 uncaptured python exception, closing channel <FTPServer listening :8021 at 80ae468> (socket.error:(111, 'Connection refused') [ZServer/medusa/asyncore.py|poll|61] [ZServer/medusa/asyncore.py|handle_read_event|291] [ZServer/ZServerFTP.py|handle_accept|714] [ZServer/ZServerFTP.py|__init__|178] [ZServer/medusa/ftp_server.py|__init__|96] [ZServer/medusa/ftp_server.py|respond|241] [ZServer/medusa/ftp_server.py|log|233] [ZServer/medusa/logger.py|log|160] [ZServer/medusa/resolver.py|resolve_ptr|321] [ZServer/medusa/resolver.py|resolve_ptr|231]) log: closing channel 11:<FTPServer listening :8021 at 80ae468> log: adding channel <trigger at 8118860> log: adding channel <http_server at 81a2a20> Warning: computing default hostname Medusa (V1.4) started at Thu Apr 15 08:34:36 1999 Hostname: fritz.homenet.net.au Port:9673 log: adding channel <FTPServer at 80ae468> FTP server started at Thu Apr 15 08:34:36 1999 Authorizer:None Hostname: localhost Port: 8021 log: adding channel <PCGIServer at 81a4770> Incoming connection from 127.0.0.1:1029 uncaptured python exception, closing channel <FTPServer listening :8021 at 80ae468> (socket.error:(111, 'Connection refused') [ZServer/medusa/asyncore.py|poll|61] [ZServer/medusa/asyncore.py|handle_read_event|291] [ZServer/ZServerFTP.py|handle_accept|714] [ZServer/ZServerFTP.py|__init__|178] [ZServer/medusa/ftp_server.py|__init__|96] [ZServer/medusa/ftp_server.py|respond|241] [ZServer/medusa/ftp_server.py|log|233] [ZServer/medusa/logger.py|log|160] [ZServer/medusa/resolver.py|resolve_ptr|321] [ZServer/medusa/resolver.py|resolve_ptr|231]) log: closing channel 11:<FTPServer listening :8021 at 80ae468> log: adding channel <trigger at 81188c8> log: adding channel <http_server at 81a2a38> Warning: computing default hostname Medusa (V1.4) started at Thu Apr 15 08:36:40 1999 Hostname: fritz.homenet.net.au Port:9673 log: adding channel <FTPServer at 80ae468> FTP server started at Thu Apr 15 08:36:40 1999 Authorizer:None Hostname: localhost Port: 8021 log: adding channel <PCGIServer at 81a4798> Incoming connection from 127.0.0.1:1048 uncaptured python exception, closing channel <FTPServer listening :8021 at 80ae468> (socket.error:(111, 'Connection refused') [ZServer/medusa/asyncore.py|poll|61] [ZServer/medusa/asyncore.py|handle_read_event|291] [ZServer/ZServerFTP.py|handle_accept|714] [ZServer/ZServerFTP.py|__init__|178] [ZServer/medusa/ftp_server.py|__init__|96] [ZServer/medusa/ftp_server.py|respond|241] [ZServer/medusa/ftp_server.py|log|233] [ZServer/medusa/logger.py|log|160] [ZServer/medusa/resolver.py|resolve_ptr|321] [ZServer/medusa/resolver.py|resolve_ptr|231]) log: closing channel 11:<FTPServer listening :8021 at 80ae468> -- --------------------------------------------------------------------- Jim.Bickford(a)flinders.edu.au Biological Sci Flinders University 61 8 8201 3179(v) 61 8 8201 3015(f) South Australia 5042 ---------------------------------------------------------------------

1 0

Has anyone tried to make Zope invisible using IIS
by Jay, Dylan 15 Apr '99

15 Apr '99

I basically want to make a virtual directory that points to everything on the other side of the PCGI exe file however stupid IIS seems to be only able to make a real directory a virtual directory. Has anyone found a way around that?

1 0

permission and role questions
by Keith Rohrer 15 Apr '99

15 Apr '99

I'm working on designing a web application, and right now I'm particularly scrutinizing Zope's permission model. In trying to think how I'd use it to do what our existing, highly custom system does today, I wonder: 1) How does one examine the logged-in user's username from DTML? I think I just need the variable name here... 2) Once I know the user ID, how can I get a list of places the user is permitted, so that all users can enter via one "front door" that always shows exactly those rooms the user may enter? 3) Is there any form of permission inheritance or impersonation implemented? Our application interfaces with other systems, and maps some local user IDs to remote user IDs. Assistants log in with their own IDs, then pick a "primary" user on whose behalf to work; the system then uses the "primary" user's permissions and presents the "primary" user's remote credentials. I'm thinking I'll have to do this myself, since I need to keep both IDs around for auditing info...fortunately I'm already expecting to use a custom authentication layer (ever try to time out a session with basic authentication?). 4) The security screen's permission settings have "acquire" checkboxes, whose point is obvious, and per-role checkboxes. I take it those enable permissions? So we can allow inherited permissions, and we can explicitly add permissions, but there's no way to add-only-if-inherited or inherit-but-deny-particular-loons-anyway? Also, the permissions on intervening levels of the tree are not checked, only inherited, right? 5) If I define users at a high level, can I grant those users roles defined at deeper levels? This would make my job with point (2) much easier, as I could create roles Foobar_Peon and Foobar_Boss in the Foobar folder, then offer the user buttons into Foobar if they have Foobar_whatever roles... 6) Is there any plan for, or how hard would it be to implement, a "reverse" permission manipulation screen where the role is fixed and the subsystems are columns? I'm largely looking at Zope and ACE--and may wind up using them in conjunction somehow--to recommend as frameworks; ACE (plus TAO) has good RPC and OS abstraction layers for C++, while Zope is a much richer framework for web applications. If I have to write in permission checking and proxy users along with the audit trail and the actual application functionality, no biggie... Keith (I may need to inhale the developer docs now...)

1 0

RE: [Zope] Is someone using Zope in Europe : A new buggy platform/os : linux alpha 5.1???
by Gilles.Lavaux 14 Apr '99

14 Apr '99

Rik Hoekstra wrote: > I know, it is WinNT/95. There There is not much to be done about it .... Hello. No, it's not Windows something: I run Zope on a Dec Alpha Miata + Linux Red-Hat 5.1 + python 1.51. I use a PostgreSQL DB and every SQL date parsing works great. I have discovered this timezone pb. with the calendar tag. If someone has successfully patched the DateTime module (or something else) on this platform, please mail me. I have also a red-hat 5.2 alpha box. So I guess I will have to try it. Thanks for the article reference. Gilles

1 0