Verbose Security Product

Verbose Security is integrated into Zope 2.8.1 and above. The product downloadable from this page is for Zope 2.7 only. To enable verbose security in Zope 2.8.1+, just set the following options in zope.conf:

security-policy-implementation python
verbose-security on

VerboseSecurity is an add-on product for Zope that helps explain the reason for denied security access.

Zope has a flexible, fine-grained security model that lets you configure context-dependent mappings from users to roles and from roles to permissions. The model fits most organizations' needs and has been used all over the world, but the flexibility sometimes comes at a price of complexity.

One major difficulty in using the Zope security model is its lack of clarity when access is denied. Because production sites should not reveal too much about the site to those who are denied access, the lack of verbosity in the default Zope security policy is appropriate for such sites. But site developers need more details.

This product attempts to explain the complete reasoning for failed access. It shows what object was being accessed, what permission is required to access it, what roles map to that permission in that context, the executable object and its owner, the effective proxy roles, and other pertinent information. All of this information appears in the exception message when access is denied.

Version 0.6 of this product is compatible only with Zope 2.7. Recent changes are listed here.

Download: VerboseSecurity-0.6.tar.gz
Released: 16 June 2004
MD5 sum: 3086d8eb7a9d461d63b4df5b6bab3658