[Zope] Re: [Zope3-dev] a note on groups and roles

[Lennart Regebro]

From: "Chris McDonough" <chrism@zope.com>
> and not with users.  Additionally, this set of ideas obviates the need
> for "local roles" because users and groups are *always* defined in a
> place.  Adding a group and associating permissions with the group to the
> place represented by the root container or to an individual leaf object
> twelve levels deep actually becomes the same operation.

I dont' understand this part at all. Either it is possible to have different
permissions in different places, or it's not. With a roles system, this is
done by giving people roles locally.
If you scrap the roles, then it means you either have to assign people to
groups locally, ie local groups, or you must be able to set the permissions
locally, ie local permissions. So your suggestion doesn't obviate the need
for local roles, it just creates a need for something other that is local,
since you don't have any roles at all, and therefore obviously can't have
local roles. :-)

I any case:
There are a lot of permissions in a Zope system. When adding some more
products, you get even more permissions. Roles are a grouping of
permissions, and is neccessary to make the permission system mangeable. If
you each time you need to locally change the permission settings for a group
of a person have to wade through 30-40 permissions and remember exactly what
each of them does, you will only end up with giving most people the rights
to do almost everything.

The only problem with the Roles system is that people over and over again
mistake it for usergroups, since they are expecting usergroups. This can be
fixed by having some type of usergroups in addition to the roles. Then
people won't think roles are usergroups, read the documentation and see the
light. Besides, some type of user grouping is necessary.

Also, the Anonymous and Authorized roles should be removed, because these
are not proper roles, and may add to the confusion of roles and groups.
Anonymous should be a built-in and non-removable principal. If it helps to
clear up the roles concept, maybe some other roles like "Author", "Viewer"
or "Member" should be created by default. But "Authorized" is a state, not a
role.

> FWIW, relatedly, I don't understand the use of the term "principal"
> instead of "user" for the "entity with credentials" in Zope 3.

Neither do I. For me "principal" means "headmaster". :-)