[Zope] Authentication on a Folder?

Mon Sep 11 13:05:25 EDT 2006

Ferhat Ayaz wrote at 2006-9-11 01:05 -0700:
>I want to restrict access to a subfolder:
>
>Folder structure:
>---------------------------------
>Root Folder
> +- MySite
>      +- Admin
>
>
>Access limitation:
>---------------------------------
>My Site: Public for all
>Admin: Only with Basic Authentication
>
>Notes:
>---------------------------------
>My page templates under 'MySite' use Script (Python)
>calls from Admin folder like:
>
>index_html (in MySite):
>---------------------------------
><html>
>...
><tal:contain define="user container/Admin/getUser">
> ...
></tal:container>
>...
></html>
>
>But 'getUser' should not be able for access from
>outside the application server.
>
>How can I do this? 

What you want is difficult to achieve (if I disregard, that (in some speaking)
no access to 'getUser' is possible "from outside" the application server --
all (Web access) will go through the application server).

The easiest solution would be to move the objects that should
be used from public code out of "Admin" and put it in a separate
folder, say "Admin_public". There is a product around that prevents
traversal from entering a folder. This way, you can prevent
that your "getUser" is used directly from the Web.
Do not ask me how this product is called -- I forgot and will not
search for you.

An alternative (to the product) would be a "SiteAccess" "AccessRule".
Be warned however, that such a rule can be disabled through special
url path segments. If not using "getUser" and friends is vital,
then you would need to change the "AccessRule" code to prevent
disabling by special urls.

And, as others already pointed out: you can use "proxy roles".
But, of course, many scripts might need to get such roles...

-- 
Dieter