Zope and User Authorization

Sometimes, in order to understand Zope, one has to return to the roots of Zope - a little engine with a funny name called Bobo.

Through the help of the wayback machine, this article Python Object Publisher - Publish Python Objects on Web Servers explains how user authorization is implemented.

If the user database is a mapping object, then the keys of the object are role names and values are the associated user groups for the roles. Bobo attempts to validate the user by searching for a user name and password matching the user name and password given in the HTTP Authorization header in a groups for role names matching the roles in the published object’s __roles__ attribute.

ZPublisher/BaseRequest.py

def old_validation(groups, request, auth, roles):
   :
   :
   # groups is acl_users
   #.. paraphrased ...
   # acl_users['NormalRole'] =
   #   {'peter': ...
   #    'tom':
   #   }
   user_maps =
     [groups[role] for role in roles if groups.has_key(role)]
   for user_map in user_maps:
     user_map.has_key(username): return username

Note: This content was migrated from http://teyc.editthispage.com/