I have read lots of specification about the Delegating / Role and the function getUserDetails which read the following data in order to work properly and provide extra informations from database to framework via query: NAME, PASSWORD, ROLE.
What combination of plugin such as "ZODB User Manager" / "Scriptable Plugin" are needed to do this?
After numerous attempts I still can't get it working.
Thank you very much for taking the time to resolve this question
I think this can be a good starting point, add roles and groups dynamically based on http headers. It is a multiplugin plugin (implements different interfaces).
Pollicino via Plone Community wrote at 2022-11-7 11:00 +0000:
I am working with Zope v5 and I must integrate new dinamic roles (database defined) to the standard AccessControl library:
AccessControl already supports user defined roles
via the AccessControl.rolemanager.RoleManager
attribute __ac_roles__.
Usually, this is a static attribute (directly defining the roles
known by this RoleManager).
But in your own RoleManager class, you could make it
dynamic.
The __ac_roles__ attribute mentioned above would make
the custom roles known to the ZMI access page (i.e. manage_access)
and allow you to use them in the permission to role mapping.
It would not give a user different roles.
For this, you would need a custom user/user folder implementation,
e.g. Products.PluggableAuthService -- as suggested by other
commenters.
Hi all
I tried creating a "Delegating" Object, and put in it the "User Folder".
The idea is to insert an SQL method into the "User Folder" but in the Delegating obj I cannot associate the Interface IUserEnumerationPlugin (because it does not appear in list of it).
Is this the right way or I am wrong with some step?
Pollicino via Plone Community wrote at 2022-12-6 14:39 +0000:
...
I tried creating a "Delegating" Object, and put in it the "User Folder".
The idea is to insert an SQL method into the "User Folder" but in the Delegating obj I cannot associate the Interface IUserEnumerationPlugin (because it does not appear in list of it).
With Products.PluggableAuthService,
each plugin type supports only a small number of interfaces.
Formerly, you wrote about your need to get roles from a database.
Role related interfaces are IRolesPlugin, IRoleAssignerPlugin
and IRoleEnumerationPlugin.
You likely need your custom plugin implementation implementing
some of those interfaces to get roles from a database
(as the database schema is likely propriatary).
Now you speak about IUserEnumerationPlugin.
This indicates that you do not only have roles in the database
but other user information as well. In this case, your plugin
must support additional interfaces.
making psql_scripts obj (with interface : Roles getRolesForPrincipal)
into acl_users(PAS) and putting in it a pyscript "getRolesForPrincipal" quering my DB
returning a list of roles, but the follow code cannot integrate extra roles:
Pollicino via Plone Community wrote at 2022-12-9 09:09 +0000:
I looked for documentation and the idea was to :
making psql_scripts obj (with interface : Roles getRolesForPrincipal)
into acl_users(PAS) and putting in it a pyscript "getRolesForPrincipal" quering my DB
returning a list of roles, but the follow code cannot integrate extra roles:
Have you activated your plugin for the roles interface?
It is not sufficient to have the plugin installed, it must also
be activated.
If things reamin strange, you might try debugging to clear things up.
A starting point could be to put a (code) breakpoint into your plugin.
If it is not hit, you made something wrong with your plugin integration.
This is an old thread now, but ive made 2 products that can do this for you.
I had basically the same needs as you described here.
And others might find this useful, so i reply even if far too late.
The first is a Zope database adapter that you might find easier to connect to databases with.
That adapter lets you basically use whatever database you like.
The second one is a Wizard, that helps you set up PAS and connect it to the database.
It needs a DB adapter, so i provided the one above, but its happy with SQLAlchemy or any other way that lets ZSQLmethods talk to a DB.
PAS have for far too long just felt like they hand you a bucket of cogwheels and no instruction on how to set it up. It is VERY powerful way to do authentication.
So i simplified the process of connecting it to the database, and i made choices available to ser it up using 2FA if you want to.
Also you CAN migrate from an existing users table, but i dont recommend that.
Set up new tables and load them in.
You can set up Roles on the user, theyre NOT replicated to the Zope interface, i felt that was something for the manager to do.
But editing is now really easy.
i have made provisions in the Wizard to store “profile” data, i.e extra fields in the db to store
data that is not part of the security model and split them apart.
You can find the wizard here:
Ask any question you like, i cannot guarantee a quick reply, i have this thing called “work” that keeps me from doing as much of this as i want to.