From 649923746d5a1e8d3d3487640d99903fd0169c08 Mon Sep 17 00:00:00 2001 From: Chris McDonough Date: Sat, 26 Jul 2008 06:21:00 +0000 Subject: Tweaks. --- docs/narr/security.rst | 37 ++++++++++++++++++++----------------- 1 file changed, 20 insertions(+), 17 deletions(-) (limited to 'docs/narr/security.rst') diff --git a/docs/narr/security.rst b/docs/narr/security.rst index 6215bf1bc..7adeda3b9 100644 --- a/docs/narr/security.rst +++ b/docs/narr/security.rst @@ -6,11 +6,8 @@ prevents views that are protected by a :term:`permission` from being rendered when the user represented by the request does not have the appropriate level of access in a context. -Jargon ------- - -To learn about the jargon tossed around in this chapter, you may want -to review the :ref:`glossary`. +Security is enabled by adding configuration to your ``configure.zcml`` +which specifies a :term:`security policy`. Enabling a Security Policy -------------------------- @@ -30,18 +27,19 @@ The above insrcutable stanza enables the ``RemoteUserACLSecurityPolicy`` to be in effect for every request to your application. The ``RemoteUserACLSecurityPolicy`` is a policy which compares the ``REMOTE_USER`` variable passed in the reqest's -environment (as the sole *principal*) against any *ACL* found in model -data when attempting to call some *view*. The policy either allows -the view that the permission was declared for to be called, or returns -a ``401 Unathorized`` response code to the upstream WSGI server. +environment (as the sole :term:`principal`) against any *ACL* found in +model data when attempting to call some :term:`view`. The policy +either allows the view that the permission was declared for to be +called, or returns a ``401 Unathorized`` response code to the upstream +WSGI server. Protecting Views with Permissions --------------------------------- You declaratively protected a particular view with a permisson via the ``configure.zcml`` application registry. For example, the following -declaration protects the view named "add_entry.html" when invoked -against an IBlog context with the ``add`` permission:: +declaration protects the view named ``add_entry.html`` when invoked +against an ``IBlog`` context with the ``add`` permission::