Access Control for Lenya files

[Andreas Hartmann <an...@apache.org>]

Hi Lenya developers,

I'm currently setting up the general Lenya access control
and the following problem occurs:

- You can assign access controllers to publications.
- There is a global access controller for the Lenya files
   (e.g., lenya/index.html, lenya/lenya/css/default.css, ...)

The problem is that you can be authenticated only by one
access controller, either for Lenya or for the publication.

When you are logged in using the publication access controller,
you are not allowed to obtain any files that are protected by
the global access controller (e.g., the project logo on the
authoring pages).

There are some possible solutions:

1) No access control for non-publication files.

2) We allow multiple identities at the same time (one
    identity for each access controller). So you could log
    in multiple times. I don't know how to handle logout
    (maybe just removing all your identities).

What do you think?

Andreas



---------------------------------------------------------------------
To unsubscribe, e-mail: lenya-dev-unsubscribe@cocoon.apache.org
For additional commands, e-mail: lenya-dev-help@cocoon.apache.org