RE: [xwiki-users] Scratchpad for howto on xwiki.org

Gunter's stated requirement (as I understand it) was primarily the ability to refuse entry to users whose LDAP-supplied (not "supplier", in case you misread my note rather than mistyping your question) information didn't meet certain criteria - specifically, in his case, that the DN did not contain an O (Organization) attribute matching one of a list of authorized entities. His need, it turns out, could be satisfied by a simple regular expression, but some may need specific lists of authorized values too irregular to be distinguished by a regex and too numerous or dynamic to allow enumeration in a static list. A requirement that I had in a (somewhat) similar situation (that used a servlet filter instead of re-implementing any of XWiki's access-control services) was that information provided (via encrypted and signed cookies) by the external authentication service should determine membership in pre-established XWiki groups - three organizations had three separate spaces, and XWiki groups were created to be given access to those spaces. Eligibility for embership in the groups was determined by a wiki page containing objects of a class naming the group, a property name identifying a field in the cookie data (in this case the organization code) and a regular expression which, if matched by the named field, would indicate eligibility. Group memberships would then be updated in accordance with the indicated eligibility. As to these things, I think that the offer you often give to list members applies to you as well, no...? :> It's what I love about wikis, particularly XWiki: I get to tell my users: "Do it yourself!" or with less technical users, I borrow the Home Depot slogan: "You can do it; we can help!" In all seriousness, of course: Thanks for your input, feedback and guidance. brain[sic]