基于角色的访问控制与金字塔

Question

I am considering using Pyramid to build a middle sized web application. I would need to implement RBAC . What would be the best choice? Would it be possible to use Zope components?

Answer 1

Well Pyramid implements an ACL authorization policy which maps principals to permissions.

1. Principals are configurable by you to mean whatever you like and are derived from the request (user) itself.
2. A permission is a string attached to an individual view or "operation".

Maybe I'm wrong, but RBAC seems to fit pretty naturally into this idea. I understand that RBAC tends to be more of a global policy whereas ACLs are generally contextual and thus attached to the data. This isn't really a problem though and depends on how you plan to structure the rest of your application.

You could also fairly simply implement your own RBACAuthorizationPolicy . In Pyramid it will be passed the principals and the permission and from there you could query your access mappings to determine whether to return an Allowed or Denied value for that user.