[Zope-PAS] Authentication and Users

[Brian Ellin]

Tres put me on the right path, and now I've got a working OpenID
authentication plugin.  Thanks Tres!

The goal of this plugin is to allow OpenID to users to participate in
Zope/Plone sites without having to create a separate account on the
site, and also have them be identified by their URL.

My question is: What is the relationship between a successful
authentication and user objects on the server?  Say an OpenID user who
has never logged in before logs in with their URL and authentication
succeeds.  Is a user object automatically created?  Do i need query
the database to see if one exists, and if not then create one
manually?  If so, how do i do that?  Where can I read about this
stuff?

The current state of my plugin is that a user may type in their
identity URL and successfully authenticate.  I'm using plone to test
the plugin, and once the user has "logged in" there is not much
different from being anonymous.   Their user name shows up in the
top-left of the screen, but thats pretty much the only difference. 
I'd like the user to be able to add content, edit prefs, and leave
comments by default just like a normal user, but without having to go
through the join procedure.  I realize that this is getting into Plone
specific territory, but i'm sure the user-object creation issue
applies to any PAS auth plugin.

Any help or pointers to documentation would be a delight.

Thanks,
Brian Ellin