Hi, I'm using Zope 2.6.1 under Plone 2.5.

And here I am working on getting 2.0 out the door like a sucker. Can I borrow your time machine? But wait! Would such a CVS commit cause the universe to end? Jokes aside, I'll assume you mean 1.0.5.

I'm trying to set up certain folders so that certain users can only access those folders. Reading the Zope book, it seems as though I should be able to do this simply by creating a new User Folder in that folder, and adding users to it.

I've done this, as well as adding a Cookie Crumbler. However, the users I add can't log in. The folder is a published folder, so I go straight to that folder, enter the username and password as I've set them up in the acl_users folder at that level, but it tells me a "Sign-in failure" page. Do I also have to have the user defined at the Root level?

That's the way it works in normal Zope, but in Plone or CMF sites, things don't always work like that. The workflow stuff tends to over-ride the regular Zope machinery. In Plone, you should add all your users at the portal level and give them permissions with the "local roles" or "sharing" tabs. You could also, depending on the semantics of your situation, define new roles and make those folders available to those roles with either a new workflow state (super-published?) or an edited workflow on a new type. There's a plone-users list, by the way, where Plone questions are probably better placed. --jcc -- "Code generators follow the 80/20 rule. They solve most of the problems, but not all of the problems. There are always features and edge cases that will need hand-coding. Even if code generation could build 100 percent of the application, there will still be an endless supply of boring meetings about feature design." (http://www.devx.com/java/editorial/15511)