[Zope3-dev] Initial thoughts on the Zope3 security framework

[Lalo Martins]

On Mon, Dec 10, 2001 at 02:53:50PM -0500, Ken Manheimer wrote:
> 
> I think that, ideally, it's relatively rare to create new roles, while
> role-to-permission mappings are typically adjusted on a per-product basis,
> and role-to-account mappings are adjusted (using local roles) on a
> per-instance basis to assign privileges to particular users within the
> context of the instance.

Hmm, no. That would be the old, role-centered access control model of
Zope 1.x, which is now still supported but considered obsolete and
harmful.

The new pattern is:

creation:

- permissions: per-product (and there is no other way to create them)

- roles: locally (a "global" role is one defined in the root folder)

  exception - a few roles (Manager, Owner, Anonymous) are built-in.

- users: locally

mapping:

- permission-to-operation: per-product. A product doesn't know about
  roles and users.

- role-to-permission: locally

- user-to-role: locally (via local roles).

  In Zope 2.x it's still usual to have "global" roles for an user, but
  they're not really global - the role holds wherever the user holds,
  but remember the user is also local, so a role defined in the user
  object is more or less the same as a local role on the same context.

  In Zope3 this will be deprecated. All user-to-role mappings will be
  what we now call "local".

Of course, there are exceptions to these patterns. A lot of Products
define their own roles. CMF is one of them, but it does it "the right
way" - the roles are defined as local roles in the "CMF Site" object
by the factory method, not globally by some call in the Zope API.

[]s,
                                               |alo
                                               +----
--
  It doesn't bother me that people say things like
   "you'll never get anywhere with this attitude".
   In a few decades, it will make a good paragraph
      in my biography. You know, for a laugh.
--
http://www.laranja.org/                mailto:lalo@laranja.org
         pgp key: http://www.laranja.org/pessoal/pgp

Brazil of Darkness (RPG)      ---       http://www.BroDar.org/