Hello, Sergei. On Saturday February 28, 2009 06:09:07 Sergei Beilin wrote: > I'm planning to implement my custom RBAC, with it's model described > with Elixir. > > 1. What should I take into consideration when planning the model? > 2. What changes do I need in my TG2 app config/code?
Elixir is not officially supported (yet), but this doesn't mean that you can't make it work. Unfortunately, I'm not an Elixir user so I can't help here. > Next, I plan to make a [mostly] mandatory access control, that is, > that by default noone, but explicitly defined roles, have access to > any controller (except the "/" and "/login" handler controller). The > current usage of repoze.what in TG2 seems to be more DAC. So, > > 3. How should I use repoze.what to get closer to MAC? Another bad news is that MAC policies will be supported as of repoze.what v2. repoze.what v1 can't, by design, support MAC policies. It can only support DAC policies because the only way to restrict access is by attaching a predicate checker to controller actions. Therefore, unfortunately the only way to get closer to a MAC policy is to cover all your controller actions with predicate checkers -- which of course has little/nothing to do with MAC; in fact, attaching predicate checkers to controllers is anti-MAC. :( If, on the other hand, what you want is a DAC policy whereby a predicate checker covers the whole application, then that's perfectly possible. For example, you can force that to grant access to any controller, users must be logged in (but of course, some URls like "/login" must be whitelisted). Is this want you want? It's not a MAC policy strictly speaking because it's not a "access is denied unless told otherwise" approach, but it's very similar. Cheers, -- Gustavo Narea <http://gustavonarea.net/>. Get rid of unethical constraints! Get freedomware: http://www.getgnulinux.org/ --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "TurboGears" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [email protected] For more options, visit this group at http://groups.google.com/group/turbogears?hl=en -~----------~----~----~----~------~----~------~--~---
