Question

In a given BrowserView I need to login as a member. This view is actually a webservice for members only. I extract the username and password from the request XML and I need to authenticate as this member.

So far, I’ve found the method :

self.portal.acl_users.authenticate(user, password, self.portal.REQUEST)

But this method only returns the member object (if the user and password are correct). It does not perform the authentication. I confirm this by executing :

from AccessControl import getSecurityManager
getSecurityManager().getUser() #Get the current authenticated user
>>>Anonymous User

I would like to know how can I authenticate as this member in this BrowserView.

Thank you

Answer 1

I’d create a new security manager for such a job, after authentication:

from AccessControl.SecurityManagement import newSecurityManager
from AccessControl.SecurityManagement import getSecurityManager

uf = self.portal.acl_users
if not uf.authenticate(user, password, self.request):
    # Unauthorized, better raise a 401 here.

smanager = getSecurityManager()
user = uf.getUserById(user)
if not hasattr(user, 'aq_base'):
    user = user.__of__(uf) # acquisition wrap the user
newSecurityManager(self.request, user)

# Do anything the new user should be able to do

setSecurityManager(smanager)