There are a few assertions in that text insinuating that writing back to the LDAP directory is a bad thing. That's not true, it's as transparent as reading from the directory and there's nothing bad about it per se. As a matter of fact it can be *very* safe if you know how to either write the Python-based application to have sensible "access controls" or if you write the directory ACLs well. Also, there's nothing "complicated" about it. The complication rests with the application that uses the user folder because it will have to know a few things about the directory structure and the schemata used.

'If you decide to store your groups in LDAP, it won't be possible to give Zope roles to those groups.' - This needs correction/clarification. The document is pretty fast and loose about some terms being used, especially "group" and "role". It is very important to note that "group" in LDAP are a far more generic concept and don't have much in common with the concept of "groups" as used in GRUF, or with "roles" as used in Zope/Plone/GRUF. Group records in LDAP are simply containerish objects that store pointers to other records, nothing more.

'By default, LDAPUserFolder expects your user class to have the following structure:' - This assertion and the example tree structure shown below it make it sound as if there are strict limits or conventions. But there aren't. The requirements are pretty loose. It would be better to just call the structure shown an "example that works", not "this is how it must be done".

'rdn attribute: (LDAP side) That's the attribute used as the rdn (it's easy !). This is used only with read-write directories, to create new entries in the database.' - That sentence makes no sense I'm afraid.

'member: cn=User1's name, ou=people, o=Organization, c=US' - It is *very bad form* to encourage users to use special characters in LDAP attribute values, or to use whitespace after the comma-separator. This is like teaching a child really bad manners. Thise things may work in one application but not in others.

Under the heading "LDAP Groups" it says 'First of all, LDAP supports groups and not roles.' and then 'BTW, you cannot assign a role to a user if that role doesn't already exist in LDAP'. Roles don't exist in LDAP, the second statement is confusing.

jens