HI all, I followed the thread yesterday on restricting access and as that is something I need to do now, I thought I'd have a go. I have a folder at the root level called 'Upload'. Upload has an acl_users folder with one user that has the 'Manager' role. I opened the index_html DTML document and changed the 'Acquire Permission Settings' security tag for 'view' to be off (all other acquires are on and the only role checkboxes set are for Manager). There is an acl_users folder at the top level (must be, because you can't delete it), but there's no one in it. If I try to access the url Upload/ I get the authentication dialog (good so far), but the *only* user that will let me through is the superuser one. If I add a user to the top level acl_users folder (different name to the Upload acl_user), then I *can* get into the system. Is this behaviour normal? Am I missing my dose of Zope-Zen this morning? Zope2.0b1 on Solaris 5.6 tia Tone ------ Dr Tony McDonald, FMCC, Networked Learning Environments Project http://nle.ncl.ac.uk/ The Medical School, Newcastle University Tel: +44 191 222 5888 Fingerprint: 3450 876D FA41 B926 D3DD F8C3 F2D0 C3B9 8B38 18A2