672 lines
24 KiB
Plaintext
672 lines
24 KiB
Plaintext
The Unenlightened Zopistas Guide to exUserFolder.
|
|
(C) 2001-2003 Andrew Milton <akm@theinternet.com.au>
|
|
|
|
0. INTRODUCTION.
|
|
|
|
exUserFolder is an extensible authentication product for the Zope
|
|
Application Server. It allows a user to choose from a number of
|
|
methods of authenticating their users, and allows the setting and
|
|
fetching of arbitrary properties on a User object.
|
|
|
|
Authentication methods, and Property methods do not have to use the
|
|
same backing store, so it is possible to use legacy user sources, and
|
|
still have configuration information stored about a user.
|
|
|
|
exUserFolder supports HTTP Basic Authentication, and the so called
|
|
Cookie Authentication schemes popular with most webservers.
|
|
|
|
0.1 Audience.
|
|
|
|
Everybody, and Nobody. If we build our product correctly, we shouldn't
|
|
need user documentation, that's why Nobody. For some reason, normal
|
|
sane people seem to lose all of their common sense when sitting in
|
|
front of a computer. To the point where plain messages e.g. "Please
|
|
Insert a Floppy", evoke a response of "What does that mean?" So that's
|
|
why this document is for Everybody.
|
|
|
|
This is not a guide for writing your own authentication, property, or
|
|
membership sources. You need the Zen Masters Guide to exUserFolder
|
|
document for that.
|
|
|
|
|
|
1. GETTING STARTED
|
|
|
|
exUserFolder requires Python 2.1 or above (may work with older
|
|
pythons, but, this is not supported). And has been tested on Zope
|
|
2.3.0 and above (including 2.4.3).
|
|
|
|
exUserFolder comes as a source tarball, and it does not rely on any
|
|
outside dependencies to be work. Some items may require additional
|
|
products to be installed in your Zope tree, but, simply will not
|
|
appear if these are not available. Some items may also require
|
|
external products to add functionality to them, but, at no time should
|
|
the Product not install because of these dependencies.
|
|
|
|
|
|
1.1 Installing exUserFolder.
|
|
|
|
Unpack exUserFolder in your Products directory. This can be achieved by
|
|
executing the following on most UNIX systems.
|
|
|
|
gzip -d -c exUserFolder-Ma_Mi_u.tgz | tar xvf -
|
|
|
|
where exUserFolder-Ma_Mi_u.tgz is the version of exUserFolder you have
|
|
downloaded.
|
|
|
|
On systems that have the GNU tar this can be shortened to;
|
|
|
|
tar zxvf exUserFolder-Ma_Mi_u.tgz
|
|
|
|
You should restart Zope after unpacking. Installing the product will not
|
|
affect your Zope installation in anyway.
|
|
|
|
If you go to Folder inside your Zope Management Interface, you should see
|
|
exUserFolder as a dropdown item near the bottom somewhere.
|
|
|
|
Congratulations, it's installed.
|
|
|
|
|
|
2. AUTHENTICATION SOURCES AND YOU.
|
|
|
|
The only mandatory component of an exUserFolder installation, is
|
|
choosing an Authentication Source. There are six Authentication
|
|
Sources to choose from in the default install. There are other add-on
|
|
Sources available from other parties.
|
|
|
|
Each Authentication Source is different, and assumes at least some
|
|
knowledge of that type of authentication scheme.
|
|
|
|
Most if not all sources store the password encrypted in some
|
|
manner. This means that discovering other people's passwords is going
|
|
to be more difficult, than with the standard user folder that comes
|
|
with Zope.
|
|
|
|
By default crypt or fcrypt are used, which is are DES encryption
|
|
methods. While this is not the strongest, fastest, choose another
|
|
superlative, of encryption techniques, it is certainly adequate for
|
|
protecting webpages.
|
|
|
|
In a later release exUserFolder will allow you to choose what method
|
|
is used for password hashing.
|
|
|
|
Some Authentication Sources can list the users that are available,
|
|
some cannot (or will not). Some allow you to add users, and others do
|
|
not. What features are availble depend on the individual
|
|
Authentication Source.
|
|
|
|
|
|
2.1 ZODB Authentication Source
|
|
|
|
The ZODB Authentication Source operates just like a normal User
|
|
Folder. It stores its authentication items in the ZODB as the name
|
|
suggests. This is the simplest folder to setup, requiring no
|
|
parameters.
|
|
|
|
Choosing ZODB Authentication Source is recommended for testing your install.
|
|
|
|
|
|
2.2 File Based Authentication.
|
|
|
|
File Based Authentication allows you to have a fixed set of users in a
|
|
file with their encrypted passwords. The prerequisites for this are
|
|
somewhat convoluted.
|
|
|
|
In the root of your Zope Installation, on the actual file system (not
|
|
in the ZODB), create a directory called exUsers. Make sure that Zope
|
|
has access to that directory.
|
|
|
|
This is the directory where you will create your files.
|
|
|
|
This is a read only Authentication Source. You will not be able to
|
|
create users, or modify their passwords. You can change their roles if you
|
|
choose a Property Source.
|
|
|
|
There are two parameters asked for;
|
|
|
|
2.2.1 Password File
|
|
|
|
This is the name of the file that contains your users and passwords.
|
|
It should be of the format;
|
|
|
|
username:cryptedPassword
|
|
user2:otherCryptedPasswd
|
|
|
|
I can contain other fields after the password also delimited by : but these
|
|
will not be ussed.
|
|
|
|
This file should exist inside the exUsers directory.
|
|
|
|
2.2.2 Default Role
|
|
|
|
This is the role that all users should be given when the log in. Because this
|
|
is a Read Only authentication source, you may not be able to add Roles at a
|
|
later date.
|
|
|
|
|
|
2.3 Postgresql Authentication Source
|
|
|
|
Postgresql Authentication source is an RDBMS backed user store. You
|
|
can add, change, and list users. It requires a Postgresql Database
|
|
Connection to be created before creating the User Folder.
|
|
|
|
You should be familiar with databases, and with your schema before
|
|
using this Authentication Source. If you don't already have a table
|
|
structure in place, a default schema is provided called 'pgScheme.sql'
|
|
in the exUserFolder distribution.
|
|
|
|
The required schema is very simple. You need to store usernames,
|
|
passwords, and roles. If your existing schema doesn't support a roles
|
|
column you will have to add one.
|
|
|
|
The configuration scheme looks daunting, but, it is setup to use the
|
|
defaults for 'pgScheme.sql' so if you're using this you can safely
|
|
continue.
|
|
|
|
We will run through the items.
|
|
|
|
2.3.1 Database Connection
|
|
|
|
If you have any database connections, they will be listed in the drop
|
|
down box. Choose the one that represents your connection to your users
|
|
table.
|
|
|
|
2.3.2 Table Name
|
|
|
|
This is the name of the table containing your users. If you have a
|
|
different table to the default, you should change it here.
|
|
|
|
2.3.3 Username Column
|
|
|
|
This is the name of the column inside your table that contains the
|
|
usernames or logins of your users. This should contain exactly what
|
|
the user needs to type in as their username.
|
|
|
|
|
|
2.3.4 Password Column
|
|
|
|
This is the name of the column inside your table that contains the
|
|
encrypted passwords of your users.
|
|
|
|
|
|
2.3.5 Roles Column
|
|
|
|
This is where the roles are stored. These are used to provide access
|
|
to items in Zope.
|
|
|
|
|
|
2.4 User Supplied Authentication Source
|
|
|
|
This allows you to create your methods in DTML, PythonScripts,
|
|
External Methods, or any other callable Zope item for listing,
|
|
authenticating, adding and changing your users.
|
|
|
|
It is beyond the scope of this guide to describe how to do this, but,
|
|
the API is quite well defined inside the source, and also in the
|
|
README.API document.
|
|
|
|
This Authentication Source has no configuration parameters.
|
|
|
|
|
|
2.5 RADIUS Authentication Source
|
|
|
|
This allows you to authenticate your users against a RADIUS server. If
|
|
you don't know what this means, then this User Source is not for you
|
|
:-)
|
|
|
|
You will require a RADIUS server to be operating, and for the server
|
|
that Zope is running on to have access to it. You will also need to
|
|
know the secret key to access the RADIUS server.
|
|
|
|
2.5.1 Host
|
|
|
|
This is the host your RADIUS server is running on.
|
|
|
|
2.5.2 Port
|
|
|
|
This is the port your RADIUS server is running on. Older installs may
|
|
require this to be 1645. The new 'blessed' port by IANA is 1812, and
|
|
this is now the default port.
|
|
|
|
2.5.3 Secret
|
|
|
|
Every remote host has a secret key it has to share with the server in
|
|
order to gain access to the authentication server. You need to know
|
|
this.
|
|
|
|
2.5.4 Retries
|
|
|
|
Because this is a networked authentication service, errors can
|
|
occur. This sets the number of times it will try to authenticate
|
|
before giving up.
|
|
|
|
2.5.5 Timeout
|
|
|
|
This is how long the RADIUS authenticator will wait for a
|
|
response. Because RADIUS operates over UDP, which is a connectionless
|
|
protocol, answers may never come back, or never reach their
|
|
destination in the first place.
|
|
|
|
The default is 5 seconds which is actually quite a long time.
|
|
|
|
|
|
2.6 SMB Authentication Source
|
|
|
|
This source allows you to authenticate your users in a Microsoft
|
|
Environment, using the SMB protocols. This is not the same as
|
|
authenticating via Directory Services.
|
|
|
|
If your SMB server requires passwords to be encrypted in transit, you'll
|
|
need to install mxCrypto.
|
|
|
|
2.6.1 Host
|
|
|
|
This is the host that your Authentication service is on, this is
|
|
normally an NT or Win2K server, but, it can also be a UNIX box running
|
|
Samba. This should be the NetBIOS name of the server.
|
|
|
|
2.6.2 Domain
|
|
|
|
This is the NT/Windows DOMAIN that the user is to authenticate
|
|
against.
|
|
|
|
2.6.3 WINS Server IP Address (optional)
|
|
|
|
If provided, this should be the IP address of the WINS server to be
|
|
queried to locate your auth host (see 2.5.1 above).
|
|
|
|
If you leave this field empty, the location of the authentication host
|
|
will be queried by broadcast, which works just fine if the Zope
|
|
machine is on the same subnet as your auth host but not if the auth
|
|
host is across a subnet link or if it's in the same machine as Zope
|
|
(don't ask. Apparently, some braindmamaged creature at M$ decided that
|
|
a machine shouldn't answer to its own broadcasts no matter what)
|
|
|
|
Fill in this field if you are getting "NetBIOSTimeout" errors but you
|
|
are sure that your auth host was specified correctly, or if Windows
|
|
machines in your subnet also use a WINS server.
|
|
|
|
|
|
2.7 LDAP Authentication
|
|
|
|
This source allows you to authenticate your users against an LDAP
|
|
server. This code is based on the auth_ldap module for Apache. The
|
|
documentation for these parameters is unashamedly lifted directly from
|
|
the documentation of the Apache directives for auth_ldap.
|
|
|
|
See: http://www.rudedog.org/auth_ldap/
|
|
|
|
You must choose a property source when using LDAP Authentication, all
|
|
of the properties associated with the LDAP user entry are stored as
|
|
properties when they authenticate. Items with multiple entries are
|
|
stored as a list of items.
|
|
|
|
You will need the pyLDAP module installed to use this authsource.
|
|
If you don't have it installed, you will not see an LDAP Auth Source available
|
|
for use.
|
|
|
|
2.7.1 URL
|
|
|
|
An RFC 2255 URL which specifies the LDAP search parameters to use. The syntax
|
|
of the URL is
|
|
ldap://host:port/basedn?attribute?scope?filter
|
|
|
|
ldap For regular ldap, use the string ldap. For secure LDAP, use ldaps
|
|
instead. Secure LDAP is only available if auth_ldap was compiled with
|
|
SSL support.
|
|
host:port The name/port of the ldap server (defaults to localhost:389 for ldap,
|
|
and localhost:636 for ldaps).
|
|
|
|
Once a connection has been made to a server, that connection remains
|
|
active for the life of the Zope process, or until the LDAP server
|
|
goes down.
|
|
|
|
If the LDAP server goes down and breaks an existing connection,
|
|
the Auth Source will attempt to re-connect
|
|
|
|
basedn The DN of the branch of the directory where all searches should start
|
|
from. At the very least, this must be the top of your directory tree,
|
|
but could also specify a subtree in the directory.
|
|
|
|
attribute The attribute to search for. Although RFC 2255 allows a
|
|
comma-separated list of attributes, only the first attribute will be
|
|
used, no matter how many are provided. If no attributes are provided,
|
|
the default is to use uid. It's a good idea to choose an attribute
|
|
that will be unique across all entries in the subtree you will be
|
|
using.
|
|
|
|
scope The scope of the search. Can be either one or sub. Note that a scope
|
|
of base is also supported by RFC 2255, but is not supported by this
|
|
module. If the scope is not provided, or if base scope is specified,
|
|
the default is to use a scope of sub.
|
|
|
|
filter A valid LDAP search filter. If not provided, defaults to (objectClass
|
|
=*), which will search for all objects in the tree.
|
|
|
|
When doing searches, the attribute, filter and username passed by the HTTP
|
|
client are combined to create a search filter that looks like (&(filter)
|
|
(attribute=username)).
|
|
|
|
For example, consider an URL of ldap://ldap.xuf.com/o=XUF?cn?sub?(posixid
|
|
=*). When a client attempts to connect using a username of The Jester, the
|
|
resulting search filter will be (&(posixid=*)(cn=The Jester)).
|
|
|
|
|
|
2.7.2 Bind DN
|
|
|
|
An optional Distinguished Name user to bind to the server when searching
|
|
for entries. If not provided an Anonymous bind will be used.
|
|
|
|
2.7.3 Bind Password.
|
|
A bind password to use in conjunction with the bind DN. Note that the bind
|
|
password is probably sensitive data, and should be properly protected. You
|
|
should only use the Bind DN and Bind Password if you absolutely
|
|
need them to search the directory.
|
|
|
|
2.7.4 Cert DB Path
|
|
|
|
Specifies in which directory LDAP Auth Source should look for the certificate
|
|
authorities database. There should be a file named cert7.db in that directory.
|
|
|
|
2.7.5 Compare DN On Server
|
|
|
|
When set, LDAP Auth Source will use the LDAP server to compare the
|
|
DNs. This is the only foolproof way to compare DNs. LDAP Auth Source
|
|
will search the directory for the DN specified with the require dn
|
|
directive, then, retrieve the DN and compare it with the DN retrieved
|
|
from the user entry. If this directive is not set, LDAP Auth Source
|
|
simply does a string comparison. It is possible to get false negatives
|
|
with this approach, but it is much faster. Note the LDAP Auth Source cache
|
|
can speed up DN comparison in most situations.
|
|
|
|
2.7.6 Dereference Aliases
|
|
|
|
This directive specifies when LDAP Auth Source will de-reference
|
|
aliases during LDAP operations. The default is always.
|
|
|
|
2.7.7 Group Attribute is DN
|
|
|
|
When set, this directive says to use the distinguished name of the
|
|
client username when checking for group membership. Otherwise, the
|
|
username will be used. For example, assume that the client sent the
|
|
username tjester, which corresponds to the LDAP DN cn=The Jester,
|
|
o=XUF. If this directive is set, LDAP Auth Source will check if the
|
|
group has cn=The Jester, o=XUF as a member. If this directive is not
|
|
set, then LDAP Auth Source will check if the group has tjester as a
|
|
member.
|
|
|
|
2.7.8 Compare Cache Size
|
|
|
|
This specifies the size of the cache used to cache LDAP compare
|
|
operations. The default is 1024 entries. Setting it to 0 disables
|
|
operation caching.
|
|
|
|
2.7.9 Compare Cache TTL
|
|
|
|
Specifies the time (in seconds) that entries in the operation cache
|
|
remain valid. The default is 600 seconds.
|
|
|
|
2.7.10 Start TLS
|
|
|
|
If this is set to Yes, LDAP Auth Source will start a secure TLS
|
|
session after connecting to the LDAP server. This requires your LDAP
|
|
server to support TLS.
|
|
|
|
2.7.11 Require User (one per line)
|
|
|
|
The require user directive specifies what usernames can access the
|
|
resource. Once LDAP Auth Source has retrieved a unique DN from the
|
|
directory, it does an LDAP compare operation using the username
|
|
specified in the require user to see if that username is part of the
|
|
just-fetched LDAP entry. Multiple users can be granted access by
|
|
putting multiple usernames in the box, separated with newlines. For
|
|
example, with a AuthLDAPURL of ldap://ldap/o=XUF?cn (i.e., cn is used
|
|
for searches), the following require entries could be used to restrict
|
|
access: The Jester Fred User Joe Manager
|
|
|
|
Because of the way that LDAP Auth Source handles this directive, The
|
|
Jester could sign on as The Jester, Zen Jester or any other cn that he
|
|
has in his LDAP entry. Only the single require user line is needed to
|
|
support all values of the attribute in the user's entry.
|
|
|
|
If the uid attribute was used instead of the cn attribute in the URL
|
|
above, the above three lines could be;
|
|
|
|
tj
|
|
fred_u
|
|
jmanager
|
|
|
|
2.7.12 Require Group (one per line)
|
|
|
|
This directive specifies an LDAP group whose members are allowed
|
|
access. It takes the distinguished name of the LDAP group. For
|
|
example, assume that the following entry existed in the LDAP
|
|
directory:
|
|
|
|
dn: cn=Administrators, o=XUF
|
|
objectClass: groupOfUniqueNames
|
|
uniqueMember: cn=The Jester, o=XUF
|
|
uniqueMember: cn=Fred User, o=XUF
|
|
|
|
The following directive would grant access to both Fred and Jester:
|
|
|
|
require group cn=Administrators, o=XUF
|
|
|
|
Behavior of this directive is modified by the Group Attribute and
|
|
Group Attribute Is DN options.
|
|
|
|
2.7.13 Require DN
|
|
|
|
The require dn option allows the administrator to grant access based
|
|
on distinguished names. It specifies a DN that must match for access
|
|
to be granted. If the distinguished name that was retrieved from the
|
|
directory server matches the distinguished name in the require dn,
|
|
then authorization is granted.
|
|
|
|
The following directive would grant access to a specific DN:
|
|
require dn cn=The Jester, o=XUF
|
|
|
|
Behavior of this directive is modified by the Compare DN On Server option.
|
|
|
|
2.7.14 Default Manager
|
|
|
|
This allows you to specify the username of the Manager for this area.
|
|
The manager will still need to meet auth requirements above, but, if
|
|
they do they will get the 'Manager' role added to their list of roles.
|
|
|
|
2.7.15 Default Role
|
|
|
|
This is a role to be assigned to users when they auth correctly. This
|
|
is to differentiate them from merely being 'authenticated'.
|
|
|
|
2.7.16 Examples
|
|
|
|
* Grant access to anyone who exists in the LDAP directory, using their UID
|
|
for searches.
|
|
URL ldap://ldap1.zope.com:389/ou=People, o=XUF?uid?sub?(objectClass=*)
|
|
|
|
* The next example is similar to the previous one, but is uses the common
|
|
name instead of the UID. Note that this could be problematical if multiple
|
|
people in the directory share the same cn, because a search on cn must
|
|
return exactly one entry. That's why this approach is not recommended: it's
|
|
a better idea to choose an attribute that is guaranteed unique in your
|
|
directory, such as uid.
|
|
URL ldap://ldap.zope.com/ou=People, o=XUF?cn
|
|
|
|
* Grant access to anybody in the Administrators group. The users must
|
|
authenticate using their UID.
|
|
URL ldap://ldap.zope.com/o=XUF?uid
|
|
require group:
|
|
cn=Administrators, o=XUF
|
|
|
|
* The next example assumes that everyone at XUF who carries an
|
|
alphanumeric pager will have an LDAP attribute of qpagePagerID. The example
|
|
will grant access only to people (authenticated via their UID) who have
|
|
alphanumeric pagers:
|
|
URL: ldap://ldap.zope.com/o=XUF?uid??(qpagePagerID=*)
|
|
|
|
* The next example demonstrates the power of using filters to accomplish
|
|
complicated administrative requirements. Without filters, it would have
|
|
been necessary to create a new LDAP group and ensure that the group's
|
|
members remain synchronized with the pager users. This becomes trivial with
|
|
filters. The goal is to grant access to anyone who has a filter, plus grant
|
|
access to Joe Manager, who doesn't have a pager, but does need to access
|
|
the same resource:
|
|
URL ldap://ldap.zope.com/o=XUF?uid??(|(qpagePagerID=*)(uid=jmanager))
|
|
|
|
This last may look confusing at first, so it helps to evaluate what the
|
|
search filter will look like based on who connects, as shown below.
|
|
If Fred User connects as fuser, the filter would look like
|
|
|
|
(&(|(qpagePagerID=*)(uid=jmanager))(uid=fuser))
|
|
|
|
The above search will only succeed if fuser has a pager. When Joe Manager
|
|
connects as jmanager, the filter looks like
|
|
|
|
(&(|(qpagePagerID=*)(uid=jmanager))(uid=jmanager))
|
|
|
|
The above search will succeed whether jmanager has a pager or not.
|
|
|
|
|
|
2.8 General Items.
|
|
|
|
You can choose to use standard auth, or cookie auth, and you can
|
|
decide how long you want to cache the users credentials before
|
|
retrying.
|
|
|
|
2.8.1 Authentication Type
|
|
|
|
2.8.1.1 Standard Authentication
|
|
|
|
This method causes the browser to pop up a dialog box to ask for the
|
|
username and password.
|
|
|
|
2.8.1.2 Cookie Authentication
|
|
|
|
This method allows you to use a normal HTML form to get the username
|
|
and password from the user. It also will present the default form to
|
|
the user if they try to access an unauthorised area.
|
|
|
|
|
|
2.8.1.3 Secure Cookie based Authentication
|
|
|
|
This method, like Cookie Authentication allows you to use a HTML form
|
|
to get the user details. However, the cookie it uses does not contain
|
|
any login information. It is internally checked against a cache of
|
|
hashes and the information is derived from that. This cache disappears
|
|
if you restart Zope, so this is not a good option for people who want
|
|
to persistently cache logins across sessions.
|
|
|
|
|
|
2.8.2 Credential Cache Timeout in Seconds
|
|
|
|
exUserFolder by default caches credential information, so that the
|
|
authorisation source isn't hit *for every object and page* that has to
|
|
be fetched. For remote authentication services this can slow things
|
|
down quite considerably. Even setting this to a modest setting will
|
|
quicken response times.
|
|
|
|
Setting this too long could cause problems if you want to lock out a
|
|
troublesome user. The credential cache is flushed if someone provides
|
|
a password that doesn't match the one in the cache.
|
|
|
|
|
|
2.8.3 Negative Credential Cache Timeout in Seconds
|
|
|
|
exUserFolder allows you to cache login failures for users that do not
|
|
exist. This means you don't have to go out to your auth source when
|
|
you know for certain this user is never going to be able to
|
|
authenticate.
|
|
|
|
Due to the way some auth sources are designed, this doesn't work for
|
|
auth sources like SMB Auth Source that lie initially about the user
|
|
existing (because you can't verify the existence of a user without
|
|
authenticating them), and then check the credentials later.
|
|
|
|
It's possible to create a hybrid auth source that lets this work
|
|
correctly for auth sources that can't list the users.
|
|
|
|
|
|
2.8.4 Log out users who expire from cache?
|
|
|
|
If you've got caching turned on, then this will force any user who has
|
|
their session expire to login again. Some people like to do this.
|
|
|
|
|
|
2.8.5 Activate Session Tracking for anoymous users?
|
|
|
|
For any anonymous user, a new temporary user is created. This allows
|
|
you to set/get properties for anonymous users too. Currently
|
|
experimental.
|
|
|
|
|
|
3.0 PROPERTY SOURCES
|
|
|
|
4.0 MEMBERSHIP SOURCES
|
|
|
|
5.0 TIPS FOR THE UNWARY
|
|
|
|
Generally these things apply to Cookie Authentication models, since
|
|
there is additional access required to present the login form.
|
|
|
|
5.1 Too much protection.
|
|
|
|
A lot of people try to protect a folder by placing an exUserFolder
|
|
inside. They then change the permissions on this folder to only allow
|
|
Authenticated or some Local Role to have permission.
|
|
|
|
5.1.1 The problem
|
|
|
|
When you try to access the folder, instead of getting the form, you
|
|
get a popup box, even though you chose Cookie Authentication. Even
|
|
when you enter a username and password it doesn't work.
|
|
|
|
|
|
5.1.2 What happened
|
|
|
|
You tried to access an area you don't have access to. Zope found the
|
|
closest user folder to the object you were trying to access. The user
|
|
folder decided you were not authorised and tried to display the login
|
|
form. You don't have access to view the login form, so Zope finds the
|
|
nearest user folder to the login form, which is the user folder above
|
|
the protected directory. It pops up the authentication dialog. If you
|
|
put in a valid username and password for this top level, then lower
|
|
level then displays the login form.
|
|
|
|
5.1.3 Solution 1 (preferred).
|
|
|
|
Place the user folder one level *above* the folder you want to protect,
|
|
that is in the unprotected area. Everything should work fine.
|
|
|
|
5.1.4. Solution 2 (not so preferred).
|
|
|
|
Set the 'View' permission on the docLogin form inside the acl_users
|
|
folder. You can get there by Choosing 'Contents' on docLogin and
|
|
scrolling down to the bottom.
|
|
|
|
6.0 MISCELLANY
|
|
|
|
6.1 Adding an exUserFolder from a product.
|
|
|
|
You can add an exUserFolder from a Python product fairly easily, if
|
|
not a tad messily.
|
|
|
|
|
|
from Products.exUserFolder.exUserFolder import manage_addexUserFolder, eUserFolder
|
|
|
|
manage_addexUserFolder(authId='zodbAuthSource', propId='zodbPropSource',
|
|
memberId='basicMemberSource',
|
|
cookie_mode=1, session_length=600, REQUEST)
|
|
|
|
Obviously change authId, propId, and memberId to what you want.
|
|
However, you'll need to ram in the appropriate form fields for the various
|
|
source constructors into your REQUEST.
|
|
|
|
6.2 Session Tracking.
|
|
|
|
Session tracking (currently) relies on having the credential cache
|
|
active, and a property source active. Your trackable user will only
|
|
last as long as they are not expired from the cache. You should set
|
|
the cache expiry length to be somewhat longer than normal if you plan
|
|
to use Session Tracking, and you should also be prepared to check that
|
|
the current session is valid.
|