Appengine ACL with Google Authentication

I would like to implement ACL with Google Authentication. Need some pointer regarding the possibility of the same.

Use case:

• Page X accessible only to myadmin@gmail.com

• Page Y accessible for all belong to a group Y. After registration a moderator will add/reject the user to the group Y.

• Pages are not accessible if user does not belong to any one of the above two. Unauthorized view is prohibited even though the user is authe开发者_JAVA百科nticated successfully.

I am planning to use Django for my project, any support provided by Django would be useful.

Thanks in advance.

---

You'll need to do this yourself: Implement the ACL with a datastore model keyed by the user's user_id, and fetch and check it on each request. The Users API doesn't provide anything like this built-in.

---

Here's an answer to the admin part only and possible suggestions on how to do the other part of your question:

For admin only access, I put the following lines in app.yaml:

handlers:
- url: /admin/.*
  script: main.py
  login: admin

- url: /super-restricted-area/.*
  script: main.py
  login: admin

The above will restrict the admin and super-restricted-area base urls to the administrator of the site only. You can have multiple urls restricted to the admin. After glancing through Python Application Configuration doc, I couldn't find any grouping restriction at the configuration level.

For the following, I will assume you are very comfortable with Django, using middleware and decorators in view, otherwise it might take pages to explain those two topics in details. Assuming grouping restrictions cannot be done at the configuration level, you can try putting the authorisaton code in a django middleware(if app engine supports it, django on app engine is limited) or in a decorator to your views.

In your middleware or decorator, here's something to start with:

from google.appengine.api import users

user = users.get_current_user()

if user:
    # Get the group of the user and perform your authorisation

Here's the reference for the above.