Gary Poster wrote:
We need to be able to iterate over the members of a group, given a group id. With the interfaces in, the only way to do this is to iterate over all principals known to the system, check their `groups` attribute, and if the group id is in the list then include it. This is obviously problematic.

If we constrain ourselves to the pluggable authentication utility in, we have some help, but it is pretty inconvenient and conceivably problematic. The following (untested sketch of a) approach is a good try for the common case, but won't handle nested authentication utilities, and relies on an interface not in an

from zope import component
from import interfaces

group_id = 'foo'

auth = component.getUtility(interfaces.IPluggableAuthentication)
for name in auth.authenticatorPlugins:
    plugin = component.queryUtility(
        interfaces.IAuthenticatorPlugin, name, context=auth)
if (plugin):
            principals = plugin.getPrincipalsForGroup(group_id)
        except KeyError:
    raise RuntimeError('Not Found')

Or something like that. As I said, this doesn't even handle some of the more complex cases. Whew!

Add a new interface to

class IMemberAwareGroup(IGroup):
    members = interface.Attribute('an iterable of members of the  group')

Then make the groups that the plugin generates implement the new interface.

I think I'm for it, but in some cases even though groups may be able to list all their members it may (if they're dynamically computed) turn out to be a huge list. I guess in that case you could simply not advertise that the group implements the interface.


Florent Guillaume, Nuxeo (Paris, France)   Director of R&D
+33 1 40 33 71 59   [EMAIL PROTECTED]
Zope3-dev mailing list

Reply via email to