DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG· RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT <http://issues.apache.org/bugzilla/show_bug.cgi?id=42952>. ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND· INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=42952 ------- Additional Comments From [EMAIL PROTECTED] 2007-07-23 08:32 ------- (In reply to comment #6) > Was there an issue with logging in or logging out? I've never had an issue > logging in. I thought we took care of the logging out issue in an earlier fix. ac.login bypasses the usecase authenticator entirely (it's matched in the global sitemap). but jann remarked that it is awkward that you have to grant rights to ac.logout to all roles, lest somebody find themselves unable to log out. but logging out should be orthogonal to "edit", "admin" and friends. we discussed a few approaches around that, dismissed any implicit rules we had thought about and finally i created a "session" role that gets granted to <world/> in the authoring root node (which unveiled the authorizer bug). "session" can be used to grant access to usecases that everybody needs, regardless of other privileges. (although it may be slightly misleading - to be more intuitive, session should be granted to logged-on users only, but that can only happen once we introduce an "everybody" group by default. -- Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the assignee for the bug, or are watching the assignee. --------------------------------------------------------------------- To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
