Hi Fernando,
I have a Postgresql database that stores all users, and booleans which describe permissions. The users log on in my application using a WebForm, I run a ZSQL Method and set all permissions in the Session.
I manage the security using Session calls, checking each permission and then allow or deny access to the object.
I know that it isn't the best solution, and now I want to change it! :)
Which is the best solution to solve my problem? I found pgUserFolder. But I'm not so sure if this will be the best solution. I installed that user folder once and worked perfectly. There you can manage the permissions and roles directly from zope. The folder offers you the possibility to map the authenticated users to a zope role and you can also use the local roles from the zopeDB. However, you will have to create some sql methods to migrate your users db to the pgUserFolder, but I think it is not difficult, you just have to see how users are stored there.
Regards, Josef