Install & Compatibility
Where this runs
tested against v7.3 · pip install
no network on importno background threads
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
muslpy 3.10–3.920 runs
build_error
glibcpy 3.10–3.920 runs
installs and imports cleanly · install 5.8s · import 0.584s · 45MB
50MB installed
● package 50MB
Code
Verified usage
Verified import paths — ran on the pinned version, not inferred.
setSecurityManager
✓ from AccessControl.SecurityManagement import setSecurityManager
getSecurityManager
✓ from AccessControl.SecurityManagement import getSecurityManager
UnrestrictedUser
✓ from AccessControl.User import UnrestrictedUser
✗ from AccessControl.SecurityManagement import UnrestrictedUser
UnrestrictedUser is a User type, not part of SecurityManagement.
view
✓ from AccessControl.Permissions import view
Commonly imported Zope permission constants.
This quickstart demonstrates how to set a security manager and check permissions using AccessControl. As AccessControl is deeply integrated with Zope, this example uses mock objects to simulate a Zope environment and show the core API (`setSecurityManager`, `getSecurityManager`, `checkPermission`). In a live Zope application, the Zope server handles the lifecycle and instantiation of these security components.
import os
from AccessControl.SecurityManagement import setSecurityManager, getSecurityManager
from AccessControl.User import UnrestrictedUser
from AccessControl.Permissions import view as ViewPermission
# 1. Define a mock Security Manager and User for demonstration
# In a real Zope app, these would be provided by the Zope environment.
class MockUser(UnrestrictedUser):
def __init__(self, id, password, roles, domains, permissions=None):
super().__init__(id, password, roles, domains)
self._permissions = permissions if permissions is not None else {}
def getRoles(self):
return self._roles
def has_permission(self, permission_name, context):
# Simplified check: Manager role allows everything, otherwise check specific permissions.
if 'Manager' in self.getRoles():
return True
return permission_name in self._permissions.get(context.__class__.__name__, [])
class MockSecurityManager:
def __init__(self, user):
self._user = user
def getUser(self):
return self._user
def checkPermission(self, permission_name, context_object):
# In a real Zope app, this involves complex role/permission mappings.
return self._user.has_permission(permission_name, context_object)
def validate(self, granted_roles, context_object, permission_name):
# Simplified for demonstration. Real method involves deep Zope security context.
return self._user.has_permission(permission_name, context_object)
# 2. Define a mock context object that can be secured
class Document:
def __init__(self, name):
self.name = name
def __repr__(self):
return f"<Document: {self.name}>"
# 3. Create mock users with different roles and permissions
admin_user = MockUser('admin', 'pwd', ['Manager'], 'all', permissions={'Document': [ViewPermission, 'Edit']})
editor_user = MockUser('editor', 'pwd', ['Editor'], 'local', permissions={'Document': ['Edit']})
viewer_user = MockUser('viewer', 'pwd', ['Viewer'], 'local', permissions={'Document': [ViewPermission]})
# 4. Create a document to test permissions against
my_document = Document("Secret Report")
print("--- Admin User Context ---")
setSecurityManager(MockSecurityManager(admin_user))
sm = getSecurityManager()
current_user = sm.getUser()
print(f"Current User: {current_user.getUserName()} (Roles: {current_user.getRoles()})")
print(f"Can '{ViewPermission}' on {my_document}? {sm.checkPermission(ViewPermission, my_document)}")
print(f"Can 'Edit' on {my_document}? {sm.checkPermission('Edit', my_document)}")
print("\n--- Viewer User Context ---")
setSecurityManager(MockSecurityManager(viewer_user))
sm = getSecurityManager()
current_user = sm.getUser()
print(f"Current User: {current_user.getUserName()} (Roles: {current_user.getRoles()})")
print(f"Can '{ViewPermission}' on {my_document}? {sm.checkPermission(ViewPermission, my_document)}")
print(f"Can 'Edit' on {my_document}? {sm.checkPermission('Edit', my_document)}")
print("\n--- Editor User Context ---")
setSecurityManager(MockSecurityManager(editor_user))
sm = getSecurityManager()
current_user = sm.getUser()
print(f"Current User: {current_user.getUserName()} (Roles: {current_user.getRoles()})")
print(f"Can '{ViewPermission}' on {my_document}? {sm.checkPermission(ViewPermission, my_document)}")
print(f"Can 'Edit' on {my_document}? {sm.checkPermission('Edit', my_document)}")
# In a real Zope app, you might restore the default security manager or a different one
# setSecurityManager(None) # Clears the thread-local manager
Errors
Common errors & fixes
ImportError: cannot import name 'User' from 'AccessControl.User'
Attempting to import a concrete user class directly from `AccessControl.User`. This module primarily defines interfaces and base classes, not specific user implementations for ZODB.
fixFor standard Zope installations using ZODB, import user-related classes from `OFS.User` (e.g., `from OFS.User import UserFolder`) or refer to your specific user management product. If creating custom users, implement `AccessControl.interfaces.IUser`.
Unauthorized: You are not authorized to access this resource. (or similar 'Insufficient privileges')
The current authenticated user (or anonymous user) in the security context lacks the necessary permission to perform the requested action on the target object.
fix1. Verify the active user's roles (`getSecurityManager().getUser().getRoles()`). 2. Check the permissions assigned to those roles on the specific object or its parent containers through Zope's management interface. 3. Ensure a security manager is correctly set (`setSecurityManager()`) for the current request/thread.
AttributeError: 'NoneType' object has no attribute 'checkPermission' (or similar errors when security manager is missing)
`getSecurityManager()` is returning `None` because no security manager has been established for the current thread or context. `AccessControl` relies on a thread-local security manager to be present.
fixExplicitly set a security manager using `AccessControl.SecurityManagement.setSecurityManager(my_security_manager_instance)` before performing security-sensitive operations. In a Zope application, this is typically handled automatically by the Zope request lifecycle.
Upgrade
Version history
7.3latest on PyPI · released Nov 16, 2025
Audit
Dependencies
zope.interfacerequiredProvides core Zope interface definitions, crucial for AccessControl's design.
zope.locationrequiredUsed for object location and path information, which can be relevant in security context resolution.
zope.securityrequiredAccessControl builds upon and integrates with zope.security for defining and enforcing security policies.