RE: Security model

[Mark Orciuch <ma...@ngsltd.com>]

Stefan,

Sorry for the late reply -  I just got around to testing this myself:

>Second: (not exactly about the security model, but related) In
>config_guide.html it is said that services.Profiler.newuser.template=
enables
>role-based psml. What does this mean ? Does it mean that the psml is not
>taken from a user, but from the WEB-INF/psml/roles directory ? If this is
the
>case, I do not understand what's the purpose of this. A new user has got
one
>specified role anyway and therefore all new users would get the same PSML.
So
>I can't see the advantage over taking the PSML from a user, where all new
>users get the same PSML as well.
>(I well remember that I once said something in this list about assigning
>PSMLs to new users according to role. But in the meantime I got convinced
>that this is nonsense because all new user can only get the same role.)

What this means is that when the user logs in for the first time, the
profile is generated based
on the "user" role (this is the role new users are enrolled in by default).
In other words, the user receives
a copy of profile defined for "user" role. I believe that this is a very
useful feature although incomplete.
A more complete implementation would *merge* profiles from ALL the roles the
user is enrolled in. For example,
you could have predefined roles such as News, Weather, Finance, etc. Each of
these would contain some related
portlets. On first login, the generated profile would be an aggregate of
profiles for all the roles the user is
enrolled in. This a step beyond just granting access to specific portlets
and provides something of a "profile
theme" functionality.

I am seeking this kind of functionality in my portal and that is something
on my todo list. Once implemented,
I'll contribute this to Jetspeed (if it generates interest, of course).

Best regards,

Mark C. Orciuch
Next Generation Solutions, Ltd.
e-Mail: mark_orciuch@ngsltd.com
web: http://www.ngsltd.com




--
To unsubscribe, e-mail:   <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>