le 21.02.2009 14:12 Gustavo Narea a écrit: > Checking whether the user really is authenticated (and "authenticated" means > that the user account really exists and the user provided the right > credentials on login) is a task specific to the authentication framework, not > to the authorization framework. If the authentication framework says the > current user is authenticated, the authorization framework must not question > that -- that's out of its scope. > > Yes. If you make a parallel with "connected" systems like a telnet/ssh session on a system, you don't get disconnected because the sysadmin has canceled/disabled your account. You will remain with the credentials you had at login time until you logout. If you don't want an identified user to remain connected after you disabled his account, I think that you should check who is "connected" and kill the corresponding sessions...
--~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "TurboGears" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [email protected] For more options, visit this group at http://groups.google.com/group/turbogears?hl=en -~----------~----~----~----~------~----~------~--~---
