Re: New user has less permission than the anonymous user!

Mick; though I've not looked at it deeply, I'd favour the second option.
The 'anonymous' role is a workaround, thought as a mean of providing public
access to the system building upon the existing infrastructure. So I don't
see the need for configuring if a new user must get the anonymous role.
*Every user* must get it, so he will not miss privileges when logged in
(stop doing things he was able to do when not logged in).

Indeed, I think there are some explicit checks for anonymous in the code,
for the same reason. It's not a 'configurable' role, it's part of the
implementation.

Anyway, being able to define a per-module default role is interesting per
se, though it's probably a different issue.

Regards,

_
Jorge

On Wed, Apr 30, 2008 at 11:04 AM, Mick Semb Wever <[email protected]>
wrote:

> >>> New user should IMHO always have the same permissions as the anonymous
> >>> user.
> >
> > I just hit this problem again and searching the archives
> > http://scarab.tigris.org/servlets/BrowseList?
> list=users&by=thread&from=333991<http://scarab.tigris.org/servlets/BrowseList?list=users&by=thread&from=333991>
> >
> > it appears the problem never got fixed.
>
>
> I see a number of potential fixes here as follows
>
> 1) Hussayn's suggestion to have an extra property
> "scarab.user.role.default"
>
> > What about setting the "default role" for new users per configuration?
> > scarab.user.role.default=anonymous
> > In addition to this global configuration setting, we could enable
> > setting the default role per module via the module editor and
> > SCARAB_GLOBAL as store ...
>
> I gather then to add this default role to the user in
> ScarabUserImpl.createNewUser()
>
>
> 2) Reuse the "scarab.anonymous.rolename" property.
> Then in
> ScarabUserImpl.createNewUser()
> check if anonymous login is permitted and if so add the anonymous role to
> the new user.
>
>
> My preference is for the latter option. If i've understood things
> correctly is isn't in fact a "more complex configuration", in fact it's
> simpler as it reuses existing properties, and solely tackles the problem
> of a new user having less permissions than the anonymous user.
>
> Maybe explicitly granting the role in
> ScarabUserImpl.createNewUser() isn't the only way. Can anyone suggest a
> smarter way?
>
>
> I will implement the latter option now and see how it goes. If it works
> and i hear nothing in the next few days, silence is consent, i'll commit
> it.
>
> ~mck
>
> --
> "The only thing I know, is that I know nothing." Socrates
> | www.semb.wever.org | www.sesat.no | www.sesam.no |
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: [email protected]
> For additional commands, e-mail: [email protected]
>
>


-- 
_
Jorge Uriarte Aretxaga
http://www.linkedin.com/in/jorgeuriarte