authentication/authorization

Hi all (after a long time :),

as I start to work with skunkweb again I would like to know which
approach you experts choose if you have to implement closed areas in a
website, possibly with different levels of users rights (speak: how to
do authorization?).

My first (two years old but still working) approach was to require
authentication through a scope configuration in sw.conf. The
components then check that parameters are valid for the given
user. This is not very handy and subject to errors (you may forget the
check, of course).

I wonder if there isn't a more general approach to make components
react according to a given security policy and a security level
derived from the users authentication. A check against security
requirements derived from the scope or some other source would be
great.  Because some of you developed big sites with skunkweb I'm sure
there is a reusable general strategy.

From the docs I found the auth service with the (misnamed) authorizer
class - misnamed because it does authentication, not authorization.
But it only does authentication, so it isn't the answer to my
question.

Zope does authorization based on a starting point in the object tree
by matching roles against (required) rights. Ist there something
similar that can be plugged into skunkweb?

Regards, Frank


-------------------------------------------------------
This SF.Net email is sponsored by: NEC IT Guy Games.  How far can you shotput
a projector? How fast can you ride your desk chair down the office luge track?
If you want to score the big prize, get to know the little guy.  
Play to win an NEC 61" plasma display: http://www.necitguy.com/?r=20