[Zope] Zope security management

[Chris McDonough]

> Essentially, I'd like a way to eliminate a role in certain
> directories. For example, if anonymous users should be granted no
> access to a "/private" folder, I want to lock down /private and all
> sub-directories against anonymous access.
>
> The only solutions I've found are inadequate. What I've found:
>
> * At the root folder, find those permissions which are enabled for the
> anonymous role, and remove them in /private by de-selecting the
> "inherit permissions" checkbox and re-enable appropriate roles.
>
> * In /private, de-select _all_ "inherit permissions" checkboxes and
> re-enable appropriate roles.
>
> The first is inadequate because of the lack of control over what
> permissions are enabled for anonymous users at the root folder. If a
> particular permission is added to the root folder the next day,
> anonymous users now have a permission in /private which they should
> not have.

How will this permission be added?  Who is defining permissions for your
site?  Are you talking about permissions defined by products your download
and install or are you talking about permissions defined by products you
create?

> The second, besides being extremely tedious and error-prone, removes
> the flexibility of defining globally what permissions roles should
> play across all of the server.
>
> What am I missing?

Both of your solutions are essentially the same solution.  This solution
seems reasonable.  It sounds like it may help to define your site's security
requirements in writing.  You may find that a restructuring of the site's
containment structure makes things a lot easier.