Web Application - User Management - RBAC

[Martin]

I am putting together a simple web-app for construction of standard documents.
Basically the app will present a form for inputting the variable content /
overriding standard text and send back a complete .doc / .swx. The motivation
for using a web app instead of templates is that I have found templates too
brittle, and I would like to store the variable/overriding data in an SQL
backend.

I would like to implement RBAC(Role Based Access Control) in the app. How would
one best go about that ? is there any code available(classes/frameworks) ? would
one render pages and thereby options based on role or guard methods(i.e. call
some kind of access control object and raise exceptions if an action is not
allowed for the role, or perhaps derive all objects from an object that
automatically handles such checks when a method is called ?) or some other
approach ? I have looked at Webwares UserKit but it is apparently incomplete and
frankly I can't figure out how it works.

I am planning to use CherryPy as a framework, but would be open to another
approach.

Regards,

Martin

[Tim Hoffman]

Hi Martin

IYou probably know this already but the obvious response is to use Zope :-)

Tim

Martin wrote:

I am putting together a simple web-app for construction of standard documents.
Basically the app will present a form for inputting the variable content /
overriding standard text and send back a complete .doc / .swx. The motivation
for using a web app instead of templates is that I have found templates too
brittle, and I would like to store the variable/overriding data in an SQL
backend.

I would like to implement RBAC(Role Based Access Control) in the app. How would
one best go about that ? is there any code available(classes/frameworks) ? would
one render pages and thereby options based on role or guard methods(i.e. call
some kind of access control object and raise exceptions if an action is not
allowed for the role, or perhaps derive all objects from an object that
automatically handles such checks when a method is called ?) or some other
approach ? I have looked at Webwares UserKit but it is apparently incomplete and
frankly I can't figure out how it works.

I am planning to use CherryPy as a framework, but would be open to another
approach.

Regards,

Martin

[Martin]

>

Hi Martin

IYou probably know this already but the obvious response is to use Zope

Tim

Yeah, but I am doing this also as an exercise. I want to understand how to put
RBAC together. Do I really have to start from scratch ? I am not pretending to
know much about web applications, but I would think there would be a lot of
generic stuff involved ?

Martin

[Remi Delon]

> I would like to implement RBAC(Role Based Access Control) in the app. How would

one best go about that ?

Well, CherryPy comes with a module called "CookieSessionAuthenticate"
but it provides only 2 states: either a user is logged or he's not.
If a user is logged in then you'll get automatically his username.
You'll have to write your own code that checks the privileges that
this user has and if he's allowed to do such and such action or not.

It also depends on what level of precision you want the privileges to
have (it could be at the URL level or at the individual function call
level) ...

But overall, it shouldn't be too hard to implement thanks to Python
:-)

Regards,

Remi.

[Kevin Dahlhausen]

Webware for Python has a component calld 'UserKit.' It may not be
fully production ready as it stands, but could serve as a model.