cocoon-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Stefan Klein <kle...@web.de>
Subject Re: role-based access to pages and parts of pages - ideas?
Date Thu, 08 Jan 2004 19:08:32 GMT
Helma,

> Any ideas?

might not be of much use for you, cause I am not using the
authentication-fw, but I thought, I'd tell you anyway. I am using a
structure very much like the authentication-fw, but using my own actions,
thus a lot lighter and tailored exactly to my needs (thus not as nice and
flexible as the framework).

There are actions for logging in, logging out, authenticating and
protecting, just like the framework. 	My sitemap looks very much like
the one in the authentication-example without flow (thus not the one you
adopted).

Unlike the framework, my protecting action takes a parameter "role" and
it checks whether the user who is locked in has that role. If so, access
is granted. so something like:

<map:match pattern="protected">
  <map:act type="authorize">
    <map:parameter name="role" value="admin">
    
    <page-generation.../>
  </map:act>
</map:match>

That way, I keep everything in the sitemap and my actions. Also, I could
do authorization depending on the url and the user who is logged in,
e.g.:

<map:match pattern="protected/*">
  <map:act type="authorize">
    <map:parameter name="role" value="{1}">
    
    <page-generation.../>
  </map:act>
</map:match>
Here everything in protected/admin could only be accessed by users with
role admin. 


HTH. Maybe you can derive an idea for your problem from this. I am also
happy to share the code, if you want to have a look.

Stefan

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@cocoon.apache.org
For additional commands, e-mail: users-help@cocoon.apache.org


Mime
View raw message