doc/book/fr/13-security.fr.txt
author Sylvain Thénault <sylvain.thenault@logilab.fr>
Thu, 21 Jan 2010 17:03:30 +0100
changeset 4319 3b72c7e6149d
parent 93 9c919a47e140
permissions -rw-r--r--
fix #636936: read_permission relation should not be mandatory
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
32
ffe4188a33e8 Moved security description to general content.
Sandrine Ribeau <sandrine.ribeau@logilab.fr>
parents:
diff changeset
     1
.. -*- coding: utf-8 -*-
ffe4188a33e8 Moved security description to general content.
Sandrine Ribeau <sandrine.ribeau@logilab.fr>
parents:
diff changeset
     2
ffe4188a33e8 Moved security description to general content.
Sandrine Ribeau <sandrine.ribeau@logilab.fr>
parents:
diff changeset
     3
Utilisateurs de l'application : Le contrôle d'accès
ffe4188a33e8 Moved security description to general content.
Sandrine Ribeau <sandrine.ribeau@logilab.fr>
parents:
diff changeset
     4
===================================================
ffe4188a33e8 Moved security description to general content.
Sandrine Ribeau <sandrine.ribeau@logilab.fr>
parents:
diff changeset
     5
ffe4188a33e8 Moved security description to general content.
Sandrine Ribeau <sandrine.ribeau@logilab.fr>
parents:
diff changeset
     6
ffe4188a33e8 Moved security description to general content.
Sandrine Ribeau <sandrine.ribeau@logilab.fr>
parents:
diff changeset
     7
Vocabulaire
ffe4188a33e8 Moved security description to general content.
Sandrine Ribeau <sandrine.ribeau@logilab.fr>
parents:
diff changeset
     8
-----------
ffe4188a33e8 Moved security description to general content.
Sandrine Ribeau <sandrine.ribeau@logilab.fr>
parents:
diff changeset
     9
* Personne, Societe définissent deux *types* d'entité 
ffe4188a33e8 Moved security description to general content.
Sandrine Ribeau <sandrine.ribeau@logilab.fr>
parents:
diff changeset
    10
* "Personne travaille_pour Societé" déclare qu'une relation
ffe4188a33e8 Moved security description to general content.
Sandrine Ribeau <sandrine.ribeau@logilab.fr>
parents:
diff changeset
    11
  travaille_pour peut exister entre une entité de type Personne et une
ffe4188a33e8 Moved security description to general content.
Sandrine Ribeau <sandrine.ribeau@logilab.fr>
parents:
diff changeset
    12
  entité de type Societe. L'ensemble des règles de ce type appliqué
ffe4188a33e8 Moved security description to general content.
Sandrine Ribeau <sandrine.ribeau@logilab.fr>
parents:
diff changeset
    13
  à la relation "travaille_pour" définit le schéma de la relation
ffe4188a33e8 Moved security description to general content.
Sandrine Ribeau <sandrine.ribeau@logilab.fr>
parents:
diff changeset
    14
  "travaille_pour"
ffe4188a33e8 Moved security description to general content.
Sandrine Ribeau <sandrine.ribeau@logilab.fr>
parents:
diff changeset
    15
ffe4188a33e8 Moved security description to general content.
Sandrine Ribeau <sandrine.ribeau@logilab.fr>
parents:
diff changeset
    16
ffe4188a33e8 Moved security description to general content.
Sandrine Ribeau <sandrine.ribeau@logilab.fr>
parents:
diff changeset
    17
Description du modèle de sécurité
ffe4188a33e8 Moved security description to general content.
Sandrine Ribeau <sandrine.ribeau@logilab.fr>
parents:
diff changeset
    18
---------------------------------
ffe4188a33e8 Moved security description to general content.
Sandrine Ribeau <sandrine.ribeau@logilab.fr>
parents:
diff changeset
    19
42
24b9660ba570 mini doc fixes
Nicolas Chauvat <nicolas.chauvat@logilab.fr>
parents: 32
diff changeset
    20
Le modèle de sécurité de CubicWeb est un modèle fondé sur des `Access
32
ffe4188a33e8 Moved security description to general content.
Sandrine Ribeau <sandrine.ribeau@logilab.fr>
parents:
diff changeset
    21
Control List`. Les notions sont les suivantes :
ffe4188a33e8 Moved security description to general content.
Sandrine Ribeau <sandrine.ribeau@logilab.fr>
parents:
diff changeset
    22
ffe4188a33e8 Moved security description to general content.
Sandrine Ribeau <sandrine.ribeau@logilab.fr>
parents:
diff changeset
    23
* utilisateurs et groupes d'utilisateurs
ffe4188a33e8 Moved security description to general content.
Sandrine Ribeau <sandrine.ribeau@logilab.fr>
parents:
diff changeset
    24
* un utilisateur appartient à au moins un groupe
ffe4188a33e8 Moved security description to general content.
Sandrine Ribeau <sandrine.ribeau@logilab.fr>
parents:
diff changeset
    25
* droits (lire, modifier, créer, supprimer) 
ffe4188a33e8 Moved security description to general content.
Sandrine Ribeau <sandrine.ribeau@logilab.fr>
parents:
diff changeset
    26
* les droits sont attribués aux groupes (et non aux utilisateurs)
ffe4188a33e8 Moved security description to general content.
Sandrine Ribeau <sandrine.ribeau@logilab.fr>
parents:
diff changeset
    27
ffe4188a33e8 Moved security description to general content.
Sandrine Ribeau <sandrine.ribeau@logilab.fr>
parents:
diff changeset
    28
Pour CubicWeb plus spécifiquement :
ffe4188a33e8 Moved security description to general content.
Sandrine Ribeau <sandrine.ribeau@logilab.fr>
parents:
diff changeset
    29
ffe4188a33e8 Moved security description to general content.
Sandrine Ribeau <sandrine.ribeau@logilab.fr>
parents:
diff changeset
    30
* on associe les droits au niveau des schemas d'entites / relations
ffe4188a33e8 Moved security description to general content.
Sandrine Ribeau <sandrine.ribeau@logilab.fr>
parents:
diff changeset
    31
* pour chaque type d'entité, on distingue les droits de lecture,
ffe4188a33e8 Moved security description to general content.
Sandrine Ribeau <sandrine.ribeau@logilab.fr>
parents:
diff changeset
    32
  ajout, modification et suppression
ffe4188a33e8 Moved security description to general content.
Sandrine Ribeau <sandrine.ribeau@logilab.fr>
parents:
diff changeset
    33
* pour chaque type de relation, on distingue les droits de lecture,
ffe4188a33e8 Moved security description to general content.
Sandrine Ribeau <sandrine.ribeau@logilab.fr>
parents:
diff changeset
    34
  ajout et suppression (on ne peut pas modifer une relation)
ffe4188a33e8 Moved security description to general content.
Sandrine Ribeau <sandrine.ribeau@logilab.fr>
parents:
diff changeset
    35
* les groupes de base sont : Administrateurs, Utilisateurs, Invités
ffe4188a33e8 Moved security description to general content.
Sandrine Ribeau <sandrine.ribeau@logilab.fr>
parents:
diff changeset
    36
* les utilisateurs font par défaut parti du groupe Utilisateurs
ffe4188a33e8 Moved security description to general content.
Sandrine Ribeau <sandrine.ribeau@logilab.fr>
parents:
diff changeset
    37
* on a un groupe virtuel "Utilisateurs Propriétaires", auquel on peut
ffe4188a33e8 Moved security description to general content.
Sandrine Ribeau <sandrine.ribeau@logilab.fr>
parents:
diff changeset
    38
  associer uniquement les droits de suppression et de modification
ffe4188a33e8 Moved security description to general content.
Sandrine Ribeau <sandrine.ribeau@logilab.fr>
parents:
diff changeset
    39
* on ne peut pas mettre d'utilisateurs dans ce groupe, ils y sont
ffe4188a33e8 Moved security description to general content.
Sandrine Ribeau <sandrine.ribeau@logilab.fr>
parents:
diff changeset
    40
  ajoutés implicitement dans le contexte des objets dont ils sont
ffe4188a33e8 Moved security description to general content.
Sandrine Ribeau <sandrine.ribeau@logilab.fr>
parents:
diff changeset
    41
  propriétaires 
ffe4188a33e8 Moved security description to general content.
Sandrine Ribeau <sandrine.ribeau@logilab.fr>
parents:
diff changeset
    42
* les droits de ce groupe ne sont vérifiés que sur
ffe4188a33e8 Moved security description to general content.
Sandrine Ribeau <sandrine.ribeau@logilab.fr>
parents:
diff changeset
    43
  modification / suppression si tous les autres groupes auxquels
ffe4188a33e8 Moved security description to general content.
Sandrine Ribeau <sandrine.ribeau@logilab.fr>
parents:
diff changeset
    44
  l'utilisateur appartient se sont vu interdir l'accès
ffe4188a33e8 Moved security description to general content.
Sandrine Ribeau <sandrine.ribeau@logilab.fr>
parents:
diff changeset
    45