source: main/waeup.kofa/trunk/docs/source/userdocs/users.rst @ 12915

.. _users:

Users :sup:`in progress`
************************

Kofa distinguishes between four types of users: anonymous users, applicants, students, portal officers/managers and the zope manager. Kofa distinguishes further between authenticated and unauthenticated users and between users with and without account object.

The user authentication process in Kofa is quite complex. Briefly and in simple terms, a so-called Authenticator validates the credentials provided via the login form, fetches the matching account object, extracts the account data and finally leads to the creation of a temporary user object, a so-called principal. Kofa principals provide `name`, `title, `email`, `phone`, `public_name` and `user_type` attributes.

Anonymous
=========

Anonymous users do not authenticate and thus do not provide credentials. Their user id in logfiles is always ``zope.anybody``. These users gain two permissions: :py:class:`Anonymous <waeup.kofa.permissions.Anonymous>` and :py:class:`Public <waeup.kofa.permissions.Public>`.

Only a few actions of anonymous users are logged. These are payment data webservice requests, the execution of password mandates and the self-registration of applicants.


Applicants and Students
=======================

Logged-in applicants or students are regular authenticated Kofa users. Their user account object is an adaption of their applicant/student object. More precisely, the Applicant/Student Authenticator fetches the matching applicant/student object and turns it on-the-fly into a Kofa account object which is further used for creating a principle instance. The `applicant_id`/`student_id` attribute becomes the user name and the `display_fullname` property serves as user title.


Officers
========

Officers are users with a dedicated user account object stored in the :py:class:`users container <waeup.kofa.userscontainer.UsersContainer>` which is located in Kofa's root container. The officer accounts object has two more attributes than the principle which is created from the account data: (1) a `roles` attribute which is a list of global role names assigned to the officer, and (2) private `_local_roles` attribute which is a dictionary of local role elements.

xxxxxxxxxxxxxxxxxxxx

The latter is only for information purposes and not further used for authorization or permissions management.

The management of portal officers is done in the 'Officers' section of Kofa. The management page shoes all officers registered in the portal. The table can be easily sorted or filtered.

Manager
=======

user type      user id  authenticated  account  portal UI access