[Zope-dev] user roles & authentication
recently I noticed that methods for retrieving user roles are affected by the URL from which the user logged in using basic authentication (as opposed to the location of the user account). I don't see any authentication-related cookies at all from ZOPE, session or otherwise, just basic http authorization. the problem is this: if one authenticates at a location deeper than their user account, authorization should apply up to the level of the account. it does - any method requiring authorization is allowed to run between the point of login and the user account - but when I test with *any* of these routines between the point of login and the user account it shows only 'Anonymous' - not the expected roles. user.getRoles() _.SecurityGetUser().getRoles() user.has_role( roleName ) visiting /manage or any other objects which require authorization works between the user account and the point of login - in fact, after rendering an object which would prompt for authorization if the only role were *really* Anonymous the roles for that object and ones it contains are fixed and show the expected results with getRoles() and has_role(). this problem occurred with ZOPE 2.5.0 or 2.5.1, and IE 5.5 or NN 7.0 Grant K Rauscher GeeKieR Enterprises http://www.geekier.com/ ___ Zope-Dev maillist - [EMAIL PROTECTED] http://lists.zope.org/mailman/listinfo/zope-dev ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope )
[Zope-dev] Re: user roles & authentication
> This is how the HTTP 1/1 specification requires it to be. > Your browser follows this spec. Dieter, I understand the HTTP spec... but ZOPE does not work that way. I can use methods which require roles above where I logged in. The methods used for returning the roles themselves do not correlate with ZOPE's own actions. Therefore ZOPE has an internal inconsistency regarding user authentication with basic HTTP authorization. > Apparently, you are using a user folder that uses basic authentication. > There are user folders around that can (be configured to) use > Cookie authentication. You can also use CookieCrumber for that. yes, I've used one or two - but I'm concerned with remedying the default ZOPE authentication mechanism, which is broken > > > > Paul, thanks, but your suggestion isn't applicable since the result of AUTHENTICATED_USER.getRoles() is wrong. Grant K Rauscher GeeKieR Enterprises http://www.geekier.com/ ___ Zope-Dev maillist - [EMAIL PROTECTED] http://lists.zope.org/mailman/listinfo/zope-dev ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope )