Welcome, guest | Sign In | My Account | Store | Cart

Notice! PyPM is being replaced with the ActiveState Platform, which enhances PyPM’s build and deploy capabilities. Create your free Platform account to download ActivePython or customize Python with the packages you require and get automatic updates.

pypm install products.shibbolethpermissions

How to install Products.ShibbolethPermissions

  1. Download and install ActivePython
  2. Open Command Prompt
  3. Type pypm install products.shibbolethpermissions
 Python 2.7Python 3.2Python 3.3
Windows (32-bit)
0.8b2 Available View build log
0.8b1 Available View build log
0.8a2 Available View build log
Windows (64-bit)
0.8b2 Available View build log
0.8b1 Available View build log
0.8a2 Available View build log
Mac OS X (10.5+)
0.8b2 Available View build log
0.8b1 Available View build log
0.8a2 Available View build log
Linux (32-bit)
0.8b2 Available View build log
0.8b1 Available View build log
0.8a2 Available View build log
Linux (64-bit)
0.8b2 Available View build log
0.8b1 Available View build log
0.8a2 Available View build log
Lastest release
version 0.8b2 on Jan 5th, 2011

Use shibboleth attributes in Plone.

Change history

0.8b2 (2010-11-19)
  • fix event-handler for users outside of Plone
0.8b1 (2010-11-04)
  • use IUserLoggedInEvent to update local-roles on objects
  • removed hard dependency on AutoUserMakerPASPlugin
0.8a2 (2010-04-20)
  • fixed missing return in view-class method

System Message: WARNING/2 (<string>, line 25)

Bullet list ends without a blank line; unexpected unindent.


0.8a1 (2010-04-06)
  • copied from old-style product 0.7

System Message: WARNING/2 (<string>, line 31)

Bullet list ends without a blank line; unexpected unindent.


Detailed Documentation


Extend Plone's folder_localrole_form to grant permissions to Shibboleth users.

ShibbolethPermissions replaces the folder_localrole_form with a slightly modified page that has a Shibboleth section added. The Shibboleth section depends on configuration made in the ZMI. When configured, when a new user logs in via Shibboleth, permissions will be granted on existing objects based on user specified regular expressions.

This doesn't do anything for already existing users that log in via Shibboleth. Those users can have permissions granted via the regular Plone method, since they already exist as Plone users.

  • Zope and Plone. Tested with Zope 2.10.11 and Plone 3.3.5
  1. Add Products.ShibbolethPermissions to the eggs-section of your buildout
  2. Rerun the buildout.
  3. Restart Zope.

4. Install the plugin: Go to your-plone-site -> site setup -> Add/Remove Products, and install ShibbolethPermissions.

Using Shibboleth Permissions
For Administrators
  1. In the ZMI, in the acl_users/ShibbolethPermissions's config tab.

2. There are two input areas: the left one lists all Shibboleth attributes that will be available to users. Examples are all of the attributes listed in the setup and mapping headers. The AutoUserMakerPASPlugin's README.txt has an example PHP page that when set up, will show all of the attributes getting set by Shibboleth.

3. The right input area is a corresponding list of labels that users see for the attributes in the left area. Enter attribute labels in the right input box.

  1. Click Save.

When users have granted permissions, the ZMI's options tab will list the permissions. There will be a checkbox that allows deleting all of the rules for a path. The path will also be a link that the adminstrator can use to quickly get to the Plone sharing tab, which can be used for individual rule editting.

For Users

1. In Plone, select the sharing tab on the item you want to share. If you don't see a sharing tab, Plone doesn't think you have permissions to do so.

2. In the sharing tab, scroll down to the Shibboleth Permissions section. Each attribute that has been configured above will be show with an input field. Each input field is a Python regular expression. See the python re module at http://docs.python.org/lib/module-re.html and Dive Into Python's Regular Expressions chapter at http://diveintopython.org/regular_expressions/. Simple strings work.

  1. Select the role(s) to be granted.
  2. Click 'apply settings'.

Once you've set up a rule, Plone will show a 'Manage existing rules' form. In that, delete a rule or rules by selecting the checkbox to the left of each role you want to delete, then click 'delete selected shibboleht pattern(s)'.

To modifiy the roles granted by a rule, select the checkbox for a rule, then select roles to assign, and then click 'assign selected role(s) to selected shibboleth pattern(s)'.

To change the source values for a rule, create a new rule, then delete the old one.


To run the ShibbolethPermissions tests, use the standard Zope testrunner:

$INSTANCE_HOME/bin/zopectl test -s Products.ShibbolethPermissions


Alan Brenner, of Ithaka Harbors, Inc., under the direction of the Research in Information Technology program of the Andrew W. Mellon Foundaton, wrote ShibbolethLogin. I'd like to thank Paul Yuergens of psych.ucla.edu for testing.


For right now, email alan DOT brenner AT ithaka DOT org, or see if I'm on irc.freenode.net channels #plone, #plone4edu or #weblion as AlanBrenner.


  • Alan Brenner, Author
  • Tom Gross, Contributor

Subscribe to package updates

Last updated Jan 5th, 2011

Download Stats

Last month:7

What does the lock icon mean?

Builds marked with a lock icon are only available via PyPM to users with a current ActivePython Business Edition subscription.

Need custom builds or support?

ActivePython Enterprise Edition guarantees priority access to technical support, indemnification, expert consulting and quality-assured language builds.

Plan on re-distributing ActivePython?

Get re-distribution rights and eliminate legal risks with ActivePython OEM Edition.