[Zope-dev] Configuring PAU - Should it be this hard?

[kevin gill]

I spent approximately a weeks work (spread over a month) to get the PAU
configured with my PostgreSQL database.

When I look at what I am doing now, it seems very complicated. Please have
a look at the following and let me know if I am doing it the hard way.

This may also be helpful for anyone trying to achieve the same result.

Here is my notes:




Notes on Setting up an external authentication system for Zope3
===============================================================

I use an external database to store my data.


1.  My Security Model
=====================

I have three types of users (principal), members, casting directors and
administrators. The login information (login name, password and roles) are
stored in a relational database. I am migrating a Zope 2 system
exUserFolder based solution.

The Zope3 concept of a role is different from the Zope2 concept. In Zope3,
roles are bundles of permissions only. The user (principal) side of the
functionality is provided by groups.

I configure my security rules in the code using permissions, and I bundle
these permissions for logical users using role ZCML statements.

In the Zope ZMI I configure a PAU with three groups. I map my users
(principals) to the groups from the database. In the Zope ZMI I use the
grant tab in the [top] folder to map the roles to permissions.

Thus my relationships are:

    principals -> grouped mapped to groups in database
        groups -> mapped to roles in grant at root (ZMI)
            roles -> mapped to permissions in ZCML

2.  Configuring PAU
===================

I wrote three plugins for the PAU to get this configuration to work.

1.  I wrote a PrincipalFolder. The PrincipalFolder provides authentication
    for the principals. It also provides lists of principals for Rotterdam
    UI.

2.  I wrote a Group. The Group maps a single group to the members of that
    group.

3.  I wrote a GroupFolder. The default GroupFolder caches the data in the
    Group. To update the default GroupFolder you have to trigger events.
    The external database updates do not trigger events so this model has
    to be replaced.

I have to do the following configurations:

1.  In the manage site -> default folder create a PAU.

2.  Configure the credentials plugin. For now I use :
        'Zope Realm Basic-Auth (a utility)' and
        'No Challenge if Authenticated (a utility)'

3.  I select the PAU Plugins tab.
    I create my principal Folder
    I go back to the PAU Configure Tab and add my Principal Folder to
    the Authenicator Plugins

5.  I select the PAU Plugins tab
    I create my group folder
    I select the new group folder
    I add three new group objects. The object name maps to the 'role' on
    my database

6.  I go back to the PAU Configure Tab
    I add the new group folder to my Authenticator Plugins

7.  I select the registration tab.
    I register the PAU

8.  I go the the [top]
    I select the grant tab
    I use this to grant the configured roles to the new groups

9.  I edit the page template and add in the following to print out the
    logged in person information:

    <b>Developer Info:</b><br>
    Context: <span tal:replace="nocall: context"></span> <br>
    Logged in user: <span tal:replace="request/principal/id"></span> <br>
    Groups: <span tal:replace="request/principal/groups"></span> <br>

10. I login with the user from the database. The groups should be
    displayed in the developer info block.

Issues
======

This solution requires a second database call to get the group after the
Principal has been configured. I may have to cache when I tune the system.

I have a prefix on the user. The user ids map to prefix + the database
user id. The principal prefix is hard coded in the group folder to
generate compatible zope principal ids.