[Zope3-Users] Question: PAU, authentication, principal sources

[Robert Boyd]

I'm pretty new to Zope 3 and I'm confused about implementing custom
authentication and principal sources. I've done some custom plugins
with Zope 2's pluggable auth, and have been reading both Zope 3 books
and the APIs.

I need to implement a principals source that gets/puts the users from
LDAP (plus implement an LDAP groups source). I have used ldappas to do
LDAP authentication.

My question is, should I extend ldappas to make it into a
principalfolder, or should I use it only for auth, and write my own
PrincipalFolder (or should it be a PrincipalSource from
pluggableauth??) When I read the docs, I get the impression that auth
plugins are for authentication, and principals are defined separately.
Yet the stock principal folder implements IAuthenticatorPlugin as well
as being a place to store and create principals.

I apologize if I haven't dug deeply enough before asking the list, but
I need a clue!

Thanks,
Rob