Hello, Gustavo!
> Therefore, unfortunately the only way to get closer to a MAC policy is to
> cover all your controller actions with predicate checkers -- which of course
> has little/nothing to do with MAC; in fact, attaching predicate checkers to
> controllers is anti-MAC. :(
Hm. If I subclass from a RestController, add some repoze.what magic
there to disable access to it (let's call it MACRestController), and
then subclass *all* my RESTful controller from that
MACREstController?...
> If, on the other hand, what you want is a DAC policy whereby a predicate
> checker covers the whole application, then that's perfectly possible. For
> example, you can force that to grant access to any controller, users must be
> logged in (but of course, some URls like "/login" must be whitelisted). Is
> this want you want? It's not a MAC policy strictly speaking because it's not a
> "access is denied unless told otherwise" approach, but it's very similar.
I think it will work for me for some time until repoze.what v2 with
MAC will be released. And that will be the time to refactor the whole
application ;)
--
Sergei
--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups
"TurboGears" group.
To post to this group, send email to [email protected]
To unsubscribe from this group, send email to
[email protected]
For more options, visit this group at
http://groups.google.com/group/turbogears?hl=en
-~----------~----~----~----~------~----~------~--~---
