How does one enable a user to use a ZSyncer instance at the root folder if the user has an acl_users account at folder /spam/eggs/ (for example) but not at the root folder? I would like a user to be able to sync content only in the /spam/eggs/ folder (and its subfolders). My ZSyncer is at the root folder, but I do not want to give the user Manager permissions at the root folder. I created a new role called "Sync" at the root folder, but I'm not sure what permissions I need to enable in order to allow the user to access the operations of the ZSyncer at the root folder. I've enabled the "Use ZSyncer" permission for the "Sync" role, but this does not seem to be adequate. Any ideas? - Kamal
On Tue, Jan 13, 2004 at 04:36:59PM -0800, Kamal Gill wrote:
How does one enable a user to use a ZSyncer instance at the root folder if the user has an acl_users account at folder /spam/eggs/ (for example) but not at the root folder?
I don't think ZSyncer has anything to do with the problem. In general a user must exist at or above the place where you want to authorize him/her. So, add the user in /acl_users with restricted roles. or you could try adding a zsyncer in /spam/eggs with the same id as the one in the root. Add a zsyncer in the same folder on the destination server. -- Paul Winkler http://www.slinkp.com Look! Up in the sky! It's BLOODY RACER! (random hero from isometric.spaceninja.com)
Adding the ZSyncer in /spam/eggs on the source and destination server works fine, but I'm hoping to avoid that since we have too many non-root acl_user accounts. So here's what I tried. 1) I created a restricted role called "Sync" at the root folder and only gave it the "Use ZSyncer" permission at the root level. 2) I gave the user in /spam/eggs/acl_users an acl_user account at the root folder with only the Sync role enabled. The Sync operation returns an "access denied" error. 3) Next, I clicked the Security tab for the ZSyncer instance at the root folder and enabled all permissions for the Sync role. No luck--I'm still getting a "403: You do not have access to do that" error. Am I missing something here? What permissions do I need to enable for the Sync role and/or the ZSyncer instance at the root folder in order for a non-Manager acl_user account to use a ZSyncer instance at the root folder? - Kamal On Jan 14, 2004, at 8:07 AM, Paul Winkler wrote:
On Tue, Jan 13, 2004 at 04:36:59PM -0800, Kamal Gill wrote:
How does one enable a user to use a ZSyncer instance at the root folder if the user has an acl_users account at folder /spam/eggs/ (for example) but not at the root folder?
I don't think ZSyncer has anything to do with the problem. In general a user must exist at or above the place where you want to authorize him/her. So, add the user in /acl_users with restricted roles.
or you could try adding a zsyncer in /spam/eggs with the same id as the one in the root. Add a zsyncer in the same folder on the destination server.
--
Paul Winkler http://www.slinkp.com Look! Up in the sky! It's BLOODY RACER! (random hero from isometric.spaceninja.com)
_______________________________________________ Zope maillist - Zope@zope.org http://mail.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://mail.zope.org/mailman/listinfo/zope-announce http://mail.zope.org/mailman/listinfo/zope-dev )
On Wed, Jan 14, 2004 at 09:40:07AM -0800, Kamal Gill wrote:
No luck--I'm still getting a "403: You do not have access to do that" error.
Am I missing something here? What permissions do I need to enable for the Sync role and/or the ZSyncer instance at the root folder in order for a non-Manager acl_user account to use a ZSyncer instance at the root folder?
"Use ZSyncer" and "View management screens" should be adequate. Maybe some of the other usual suspects ("View", "Access contents information") without which it's hard to do much of anything. Maybe try installing Dieter's VerboseSecurity product? -- Paul Winkler http://www.slinkp.com Look! Up in the sky! It's GROBSANDY SUPERLATIVE FART NAYSEER! (random hero from isometric.spaceninja.com)
Paul Winkler wrote at 2004-1-14 13:13 -0500:
... "Use ZSyncer" and "View management screens" should be adequate. Maybe some of the other usual suspects ("View", "Access contents information") without which it's hard to do much of anything.
Maybe try installing Dieter's VerboseSecurity product?
It's Shane's product, not mine... -- Dieter
participants (3)
-
Dieter Maurer -
Kamal Gill -
Paul Winkler