Re: Security internals, was Re: [Zope-dev] LOTS of roles?

2003-03-07 Thread Jens Vagelpohl
hm... i could have told you that the LDAPUser class in the LDAPUserFolder product can do that but i had the whole thread mostly tuned out. initially it did not look like anything i could help with and the first posting was very long if i remember correctly. jens On Thursday, Mar 6, 2003, at

Re: Security internals, was Re: [Zope-dev] LOTS of roles?

2003-03-06 Thread Adrian van den Dries
On March 5, Paul Winkler wrote: * more coupling Yes. * performance hit Yes. * one more detail to pay attention to Yes. OTOH, doing the magic in user.allowed() would mean I'd only need one special UserFolder instance at the top of the hierarchy, and then everything else Just Works

Re: Security internals, was Re: [Zope-dev] LOTS of roles?

2003-03-06 Thread Paul Winkler
On Fri, Mar 07, 2003 at 08:56:59AM +1100, Adrian van den Dries wrote: (/me revisits LDAPUserFolder) Looks like the work is already done for you anyway: allowed() and friends check if the context has an attribute acl_satellite, and queries it for any additional roles, and it even keeps a

Re: Security internals, was Re: [Zope-dev] LOTS of roles?

2003-03-05 Thread Adrian van den Dries
On March 5, Paul Winkler wrote: I've been trying to understand how to implement dynamic local roles, Customise the Folder class and override __ac_local_roles__ with a method that returns a dictionary mapping users to roles for that object: {user: [local,roles], ...} *