|The PEAK Developers' Center||FrontPage||RecentChanges||TitleIndex||WordIndex||SiteNavigation||HelpContents|
Applications often need to provide different access to different users. In simple applications the access may be controlled by "security levels
|The PEAK Developers' Center||FrontPage||RecentChanges||TitleIndex||WordIndex||SiteNavigation||HelpContents|
Applications often need to provide different access to different users. In simple applications the access may be controlled by "security levels" that apply globally, but more complex applications may have security rules that depend on the state of application objects, or the relationship between a user and some set of objects. The peak.security framework provides tools for defining and using security rules in both simple and complex applications.
The peak.security framework allows an application to find out whether a user has permission to perform an action on some subject in some context. Specifically, an application asks a context whether the user has the permission for the subject, and receives either a true value (indicating success), or a denial object, indicating failure.
Let's look at each of these five concepts in turn, using the PEAK API to build our examples:
>>> from peak.api import security, binding
peak.security doesn't have any predefined notion of what a "user" or "principal" is, so you can use whatever objects make sense for your application -- even strings or integers if you want! For our examples, we'll just make up a simple TestUser class, whose instances hold a name, and when printed, show that name:
>>> class TestUser:... def __init__(self, name):... self.name = name... def __repr__(self):... return self.name
Let's see if it works:
>>> Bob = TestUser("Bob") >>> Bob Bob
For our examples, we could've just as easily used strings, but any significant application is going to have some kind of user object with other behaviors besides just having a name. For example, they might be stored in a database or LDAP directory, and have methods to check or change their password or other login credentials.
(Note, by the way, that the security rule framework doesn't deal with how users "log in" or "authenticate"; that's entirely up to your application. Security rules just determine what a particular user can or can't do in the application. That is, security rules determine whether or not a user has permission to do something.)
peak.security defines access rights using "permissions". A permission is just a symbol that can be used to identify 1) a group of similar users, 2) a role that users may have with respect to some object, or 3) a group of related privileges. Here are some examples of each:
>>> 