Re: ZEO authorization model?
Bill Janssen <[email protected]>
| Newsgroups | gmane.comp.web.zope.zodb |
|---|---|
| Message-ID | <[email protected]> |
I think you need to have authentication, and a very simple authorization model (access/no-access) on a per-user, per-storage basis (assuming a single ZEO server is managing multiple storages). Might extend that to read/write differentiation, but that's as far as I'd go. A few years ago I built a radically decentralized enterprise data system. Each user had their own database (an AllegroGraph store). Authorization in that system is probabilistic, and centers around who may communicate what to whom, and thus controls inter-user communication, not access to the data stores. I see ZEO as somewhat similar. Bill On Wednesday, May 25, 2016 at 6:46:55 AM UTC-7, Jim Fulton wrote: > > In the past, I've thought it would be useful to have an authorization > system for ZEO. The idea being that when connecting, one would > authenticate as a particular user and then access would be limited > depending on the access that user had. I was thinking that the > access control would be pluggable and would moderate load, create and > update operations. > > Having user access control makes a lot more sense in the traditional > client-server model, when client connections are made on behalf of a > user. It's less useful in the web-server model, where the connection > is made by the web server and not on behalf of a real user, although > distinguishing between web servers and other clients might be useful. > Perhaps in the future, browser applications will be able to connect to > a ZEO storage directly which would be a return to the client-server > model. > > I'm curious what other people think. Does anyone else have desires > for a ZEO authorization model? If so, what sort of requirements would > you have? > > Jim > > -- > Jim Fulton > http://jimfulton.info > -- You received this message because you are subscribed to the Google Groups "zodb" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.