Confusion with Pyramid authorization, __acl__, and RootFactory

Question

As a learning experience, I would like to build a site which is structured in this (simplified) fashion:

• Registered users can log in to their accounts. Each user has his own "profile"
• Once logged in, they can join certain "networks" or groups (or whatever you'd like to call them.)
• These users can only view the content of these networks if they have joined them.
• Networks have admins, each with varying, customizable permissions (x, y, and z). These admins can edit the network's content.

How can I go about achieving this (in basic terms) with Pyramid's __acl__, RootFactory, and authorization/authentication features? How would each network have its own permissions relative to the basic log-in/out feature for user accounts?

I've read the documentation multiple times, and I am starting to grasp how Pyramid security works; however, I feel as if I need some more specific clarification. For instance, in order to create the most simple of log-in features, do I need to specify an __acl__ in my RootFactory, or is this simply defining various groups, regardless of who can log in? Basic things, but also with enough "unusual" circumstance that I can see how it all fits together...

Note: I'm not looking for someone to write me code. I'm just looking for some basic specification in a situation which I do not understand.

Thanks for the help.

Answer 1

I recently added login/authentication/authorization to an URL Dispatch based pyramid application. I used a chapter from one of the official tutorials (http://docs.pylonsproject.org/projects/pyramid/en/latest/tutorials/wiki2/authorization.html). I prefered this concise chapter over the large security chapter of the narrative documentation . If you want to use Traversal, choose same chapter from official tutorial creating a Wiki in ZODB.

At least this chapter will answer your question regarding basic login/logout, create users/groups, create and apply basic ACL to RootFactory, protect views with permissions.

To address your site structure I would recommend Michael Merickels Tutorial (http://michael.merickel.org/projects/pyramid_auth_demo/index.html). It applies the concepts from the documentation about resources/security to several use cases. I really liked it, may be you get inspired too. If you come back to ask more specific questions regarding these use cases, answers could be more easy and concise than the one to your current question.