Max Ischenko wrote:
>IMHO, embedding credential system into data classes is solving the wrong
>problem. Security policy should operate on quite different (and higher)
>level instead of controlling access to object's bits. "code access
>security" feels mostly like a marketing buzzword to me.
>
>
We've been running a system for a year or so that chiefly has page-level
security. We also use the Ww actions() code to define roles/actions, but
it's been somewhat unsatisfactory.
I agree that code-level security is most often moot, but I figured if it
could be that low-level, it could also be higher level. Rather than
controlling a given CMS object, one could control a collection of them
or something like that.
I'm not interesting in buzzwords, and wasn't even aware that .NET was
doing that. I'm trying to make it so servlets don't have to deal with
security when retrieving/painting/editing objects.
>I've built simple role-based security when access to a web page is
>granted based on user's credentials and access policy for that page
>(thru the config file). Code excerpts are given below.
>
>class User:
>
> """
> Represents a user of the system.
>
> A user is identified by it's name, authenticated by password and can
> "play" one or more "roles".
>
> Users are managed by the L{UserManager}.
> """
>
> def __init__(self, mgr, name, roles=[]):
> self.mgr = mgr
> self.name = name
> self.roles = roles
> def isLoggedIn(self):
> return self.mgr.isLoggedIn(self)
> def getName(self):
> return self.name
> def playsRole(self, role):
> return (role in self.roles)
> def __str__(self):
> return "<User %s>" % self.name
>
>
Where is self.roles() and what does it look like? (if you don't mind me
asking)
Seems like you fundamentally have a lookup table that corresponds to
users and pages; I need finer control than that. But thanks for the
lead; I'll look up the .NET stuff.
|