Changes between Version 30 and Version 31 of S3/S3AAA

Timestamp:

01/18/11 00:33:47 (15 years ago)

Author:

Dominic König

Comment:

--

S3/S3AAA

@@ -147 +147 @@
 === s3_accessible_query ===
 
+=== auth.permission.fail ===
+
+In case of failure, a well-defined response action must take place:
+
+  - in interactive formats:
+    - the user should be informed that he has insufficient permissions (if already logged-in)
+    - the user should be requested to login (+forwarded to the login page)
+  - in non-interactive formats
+    - the client must receive a HTTP 401 (Authorization Required) error if not logged-in in order to trigger an authentication attempt
+    - the client must receive a HTTP 403 (Forbidden) error code to cancel its attempt properly
+
+All this is covered by the {{{auth.permission.fail()}}} method:
+
+{{{
+authorised = auth.shn_has_permission("delete", db.my_table)
+if not authorised:
+    auth.permission.fail()
+}}}
+
+For interactive modes, you can set the destinations for redirection before calling {{{auth.permission.fail()}}}:
+
+  - {{{auth.permission.homepage = URL(...)}}} for the case where the user is logged-in, but has insufficient privileges (defaults to {{{default/index}}}).
+  - {{{auth.permission.loginpage = URL(...)}}} for the case where the user is not logged-in (defaults to {{{default/user/login}}}).
+
+Example: redirect to {{{my/index}}} rather than to {{{default/index}}} in case of insufficient privileges of an authenticated user:
+
+{{{
+authorised = auth.shn_has_permission("delete", db.my_table)
+if not authorised:
+    auth.permission.homepage = URL(r=request, c="my", f="index")
+    auth.permission.fail()
+}}}
 == Data Access Tracking (Audit) ==