Index: main/waeup.sirp/trunk/src/waeup/sirp/authentication.py
===================================================================
--- main/waeup.sirp/trunk/src/waeup/sirp/authentication.py	(revision 7168)
+++ main/waeup.sirp/trunk/src/waeup/sirp/authentication.py	(revision 7169)
@@ -2,12 +2,15 @@
 """
 import grok
+from zope.event import notify
 from zope.component import getUtility, getUtilitiesFor
+from zope.interface import Interface
+from zope.securitypolicy.interfaces import (
+    IPrincipalRoleMap, IPrincipalRoleManager)
 from zope.pluggableauth.plugins.session import SessionCredentialsPlugin
 from zope.pluggableauth.interfaces import (
         ICredentialsPlugin, IAuthenticatorPlugin, IPrincipalInfo)
 from zope.password.interfaces import IPasswordManager
-from zope.securitypolicy.interfaces import IPrincipalRoleManager
 from zope.securitypolicy.principalrole import principalRoleManager
-from waeup.sirp.interfaces import (
+from waeup.sirp.interfaces import (ILocalRoleSetEvent,
     IUserAccount, IAuthPluginUtility, IPasswordValidator)
 
@@ -184,4 +187,14 @@
        return errors
 
+class LocalRoleSetEvent(object):
+
+    grok.implements(ILocalRoleSetEvent)
+
+    def __init__(self, object, role_id, principal_id, granted=True):
+        self.object = object
+        self.role_id = role_id
+        self.principal_id = principal_id
+        self.granted = granted
+
 @grok.subscribe(IUserAccount, grok.IObjectRemovedEvent)
 def handle_account_removed(account, event):
@@ -199,2 +212,44 @@
             role_manager.unsetRoleForPrincipal(role_id, principal)
     return
+
+@grok.subscribe(IUserAccount, grok.IObjectAddedEvent)
+def handle_account_added(account, event):
+    """When an account is added, the local owner role and the global
+    PortalUser rolemust be set.
+    """
+    # First we have to set the local owner role of the account object
+    role_manager = IPrincipalRoleManager(account)
+    role_manager.assignRoleToPrincipal(
+        'waeup.local.Owner', account.name)
+    # Then we have to notify the user account that the local role
+    # of the same object has changed
+    notify(LocalRoleSetEvent(
+        account, 'waeup.local.Owner', account.name, granted=True))
+    return
+
+@grok.subscribe(Interface, ILocalRoleSetEvent)
+def handle_local_role_changed(obj, event):
+    site = grok.getSite()
+    if site is None:
+        return
+    users = site.get('users', None)
+    if users is None:
+        return
+    role_id = event.role_id
+    if event.principal_id not in users.keys():
+        return
+    user = users[event.principal_id]
+    user.notifyLocalRoleChanged(event.object, event.role_id, event.granted)
+    return
+
+@grok.subscribe(Interface, grok.IObjectRemovedEvent)
+def handle_local_roles_on_obj_removed(obj, event):
+    try:
+        role_map = IPrincipalRoleMap(obj)
+    except TypeError:
+        # no map, no roles to remove
+        return
+    for local_role, user_name, setting in role_map.getPrincipalsAndRoles():
+        notify(LocalRoleSetEvent(
+                obj, local_role, user_name, granted=False))
+    return
Index: main/waeup.sirp/trunk/src/waeup/sirp/authentication.txt
===================================================================
--- main/waeup.sirp/trunk/src/waeup/sirp/authentication.txt	(revision 7168)
+++ main/waeup.sirp/trunk/src/waeup/sirp/authentication.txt	(revision 7169)
@@ -71,5 +71,5 @@
 because we do not neccessarily know where Alice lives:
 
-  >>> from waeup.sirp.users import LocalRoleSetEvent
+  >>> from waeup.sirp.authentication import LocalRoleSetEvent
   >>> from zope.event import notify
   >>> notify(LocalRoleSetEvent(chalet, 'BigBoss', 'alice',
Index: main/waeup.sirp/trunk/src/waeup/sirp/browser/pages.py
===================================================================
--- main/waeup.sirp/trunk/src/waeup/sirp/browser/pages.py	(revision 7168)
+++ main/waeup.sirp/trunk/src/waeup/sirp/browser/pages.py	(revision 7169)
@@ -40,5 +40,5 @@
 from waeup.sirp.university.catalog import search
 from waeup.sirp.university.vocabularies import course_levels
-from waeup.sirp.users import LocalRoleSetEvent
+from waeup.sirp.authentication import LocalRoleSetEvent
 from waeup.sirp.widgets.restwidget import ReSTDisplayWidget
 from waeup.sirp.authentication import get_principal_role_manager
Index: main/waeup.sirp/trunk/src/waeup/sirp/users.py
===================================================================
--- main/waeup.sirp/trunk/src/waeup/sirp/users.py	(revision 7168)
+++ main/waeup.sirp/trunk/src/waeup/sirp/users.py	(revision 7169)
@@ -1,12 +1,8 @@
-"""Users (principals) for the WAeUP portal.
+"""User container for the WAeUP portal.
 """
 import grok
 from zope.event import notify
-from zope.interface import Interface
-from zope.securitypolicy.interfaces import (
-    IPrincipalRoleMap, IPrincipalRoleManager)
 from waeup.sirp.authentication import Account
-from waeup.sirp.interfaces import (
-    IUserContainer, ILocalRoleSetEvent, IUserAccount)
+from waeup.sirp.interfaces import IUserContainer
 
 class UserContainer(grok.Container):
@@ -39,53 +35,2 @@
         if name in self.keys():
             del self[name]
-
-class LocalRoleSetEvent(object):
-
-    grok.implements(ILocalRoleSetEvent)
-
-    def __init__(self, object, role_id, principal_id, granted=True):
-        self.object = object
-        self.role_id = role_id
-        self.principal_id = principal_id
-        self.granted = granted
-
-@grok.subscribe(Interface, ILocalRoleSetEvent)
-def handle_local_role_changed(obj, event):
-    site = grok.getSite()
-    if site is None:
-        return
-    users = site.get('users', None)
-    if users is None:
-        return
-    role_id = event.role_id
-    if event.principal_id not in users.keys():
-        return
-    user = users[event.principal_id]
-    user.notifyLocalRoleChanged(event.object, event.role_id, event.granted)
-    return
-
-@grok.subscribe(Interface, grok.IObjectRemovedEvent)
-def handle_local_roles_on_obj_removed(obj, event):
-    try:
-        role_map = IPrincipalRoleMap(obj)
-    except TypeError:
-        # no map, no roles to remove
-        return
-    for local_role, user_name, setting in role_map.getPrincipalsAndRoles():
-        notify(LocalRoleSetEvent(
-                obj, local_role, user_name, granted=False))
-    return
-
-@grok.subscribe(IUserAccount, grok.IObjectAddedEvent)
-def handle_user_added(account, event):
-    """If an account is added the local owner role must be set.
-    """
-    # First we have to set the local owner role of the account object
-    role_manager = IPrincipalRoleManager(account)
-    role_manager.assignRoleToPrincipal(
-        'waeup.local.Owner', account.name)
-    # Then we have to notify the user account that the local role
-    # of the same object has changed
-    notify(LocalRoleSetEvent(
-        account, 'waeup.local.Owner', account.name, granted=True))
-    return
Index: main/waeup.sirp/trunk/src/waeup/sirp/users.txt
===================================================================
--- main/waeup.sirp/trunk/src/waeup/sirp/users.txt	(revision 7168)
+++ main/waeup.sirp/trunk/src/waeup/sirp/users.txt	(revision 7169)
@@ -1,4 +1,4 @@
-User for the WAeUP portal
-*************************
+User container for the WAeUP portal
+***********************************
 
 .. :doctest:
@@ -10,7 +10,4 @@
     ...   PlacelessSetup)
     >>> PlacelessSetup().setUp()
-
-User Containers
-===============
 
 We can create a user container which will hold the useraccounts for
