[Zope3-dev] Initial thoughts on the Zope3 security framework

[Martijn Faassen]

Lennart Regebro wrote:
> From: "Guido van Rossum" <guido@python.org>
> > I am hoping we can figure something out where in the normal case the
> > security tab shows a vastly smaller table of roles x permissions, but
> > where you can still expand permissions into subpermissions (like
> > clicking on a folder in a tree widget to see its contents, etc.).
> 
> I just had an idea. This may be stupid, it's just off the top of my head:
> In most cases when I set up security, the permission each role has are the
> same throughout the hierarchy. I mean, an Editor has the rights needed for
> editing, a reviewer the rights needed for reviewing, and so on.The thing
> that changes are which principals have wich roles in any one part of the
> web.
> 
> Therefore, it seem that it would be possible to set up the mapping between
> roles and permissions globally, and only assign roles to principals on a per
> document basis.

This would be nice, but the problem is then how to remove, say, 'View'
permissions from a certain folder so that it is closed for, say,
anonymous viewers.

> This would require the addition of an automatically generated "Not Logged
> In" principal, and the renaming of the "Anonymous" role to a "Viewer" role.
> It would probably alse result in a more fine-grained definition of roles,
> which in turn would make it neccessary to have principal groups.

I think principal groups are important to have for many applications. 
What is needed also for this scenario to work is the ability to *take away*
local roles from principal or principal group for certain objects.

I want to be able to express 'a user that hasn't logged in can view the
entire site, except this and this' as well as 'user X can view only this
and this'.

It would be nice if the permission mapping could be set for a role, and
only have the local roles of users and user group vary. I think that this
would be powerful enough, if there are ways to take away a local role, and
reducing the variability in the system while keeping or increasing the
power would indeed be good.

Regards,

Martijn