Lazy sessions and authorization (Drupal)

[Cantor, Scott]

On 11/4/13, 11:17 AM, "Peter Schober" <peter.schober at univie.ac.at> wrote:

>* Cantor, Scott <cantor.2 at osu.edu> [2013-11-04 17:09]:
>> Saying "ignore unauthorized session" is the same as not having the
>> authz rule there.
>
>I'm /guessing/ the application refuses access altogether once
>authenticated but not authorized, i.e., you can't even see publicly
>(unauthenticated) visible content?
>Maybe a local logout & return to the site could be initiated from a
>session hook instead?

Yes, I would say if that's goal, that makes a lot more sense.

But I'm just saying you can't have static access control and then have a
flag that says "or ignore it". That's the same as not having it. I don't
see how you could ever distinguish the two groups.

-- Scott