Didier Georgieff writes:

Our users are acessing to the Zope server (wich is on the Internet) thru corporate (government) firewall/proxys.

Some users in acl_users are declared with a "domain" restriction. wich is a generic "gouv.fr" or "agriculture.gouv.fr".

It doesn't seems to be effective and the login is rejected, while the same user without any "domain" restriction works fine. The code handling the "domain" restrictions is in "AccessControl.User.domainSpecMatch".

It looks at REMOTE_HOST and REMOTE_ADDR. Thus, your proxy must pass this unchanged. Dieter