[Zope-Coders] Re: "Anonymous" role is pretty bizarre?

[Steve Alexander]

> > Getting the terminology straght is hard, especially after we have all 
> > bent our brains not to fight with Zope's machinery.
> > 
> >    'Principal' -- an identifiable user, or group of users, to whom
> >      privileges are granted.
> > 
> >    'User' -- a single principal, associated with a request.  Each request
> >      has exactly *one* user, who may be the "nobody" user.
> 
> FWIW, I am all for this, but Jim and Steve's "Use" discussion that
> mentioned multiple principals being associated with the same request on
> the Zope3 list belies this.  I never did quite understand that, but I'm
> resigned to not understanding it, so that's ok. ;-)

The "Use" stuff is now called "Interactions".

What Tres says is still true.  A single principal is associated with a
request.

When we consider security in Zope 3, we need to consider the principal
associated with the request, and also other principals who are
participating in the current interaction, for example, principals who
wrote untrusted code.

--
Steve Alexander