Debugging Unauthorized / Insufficient Privileges

If you just want to see error messages instead of "Insufficient Privileges," then start with step #3. However, to get meaningful error messages you will need to install/enable Shane Hathaway's VerboseSecurity product.

For Zope 2.7

1. Install VerboseSecurity

   Download VerboseSecurity - it provides more meaningful error messages for Unauthorized errors. Specifically, it tells you where your request failed, what roles you have, and what roles you need to perform your request.

2. Restart Zope

   In the ZMI check Control_Panel/Products for VerboseSecurity.

   VerboseSecurity complains to the event log if it cannot install its security policy, so check log/event.log for messages.

   Also see the page on VS in the ZopeWiki.

3. Edit cookie_authentication

   In your Plone site go to cookie_authentication and clear out the Auto-login page ID field. Press Save Changes.

   The idea is that a security violation should no longer redirect to the login page, but display the browser's basic auth dialog.

For Zope 2.8+

1. Enable VerboseSecurity

   VerboseSecurity is built in to Zope 2.8+, but you will need to enable it in etc/zope.conf. In zope.conf, search for verbose-security and set verbose-security on. Search for security-policy-implementation and set security-policy-implementation python.

2. Restart Zope

   VerboseSecurity complains to the event log if it cannot install its security policy, so check log/event.log for messages.

   Also see the page on VS in the ZopeWiki.

3. Edit cookie_authentication

   In your Plone site go to cookie_authentication and clear out the Failed authorization page ID field. Press Save Changes.

   The idea is that a security violation should no longer redirect to the login page, but display the browser's basic auth dialog.

For all versions of Zope

1. Find a browser that fails well

   Mac OS X

   • Firefox. After you entered the login information once, you can press Cancel at the second pop-up and see the error message.
   • Opera works the same as Firefox.
   • IE 5.2 shows error message after first unsuccessful login attempt.
   • Safari and Camino can NOT be used for this!

   Windows

   • IE 5.5 & 6 require you to enter the login info 3 times before showing the error message.
   • Firefox and Opera should work like on the Mac.
2. Configure the error_log

   Plone's error log ignores Unauthorized errors by default. If you want to log these errors, then simply browse to the error_log (either in ZMI or in Plone Setup) and remove Unauthorized from the list of "Ignored exception types." Click Save and you're set.

3. Access the problem area

   Using a browser, access the part of your site causing Unauthorized errors. The browser should pop up a login dialog. Enter the credentials of the offending user at least once. This depends on the browser used, see 4.

   You should now see a Plone Site error, where the error value contains a detailed textual explanation of why access was denied.

4. Don't do this on a live system!

   If you can avoid it. Production Zopes should not run in debug mode, and not have the VerboseSecurity product installed.

Additional notes

There are cases where these error messages do not show up in the page itself, and you still get "Insufficient privileges". The verbose errors will be logged in the error.log file in your Plone instance. This is relatively uncommon, though.

The security framework generates the verbose information. If something raises Unauthorized exceptions directly, there will be no verbose information. Example for this is the at_isEditable.py script, which raises Unauthorized exceptions when there are zero editable fields in an Archetypes item. In that case you won't know which permissions you'd need.

And hey, if you get a simple "Username and password are not correct." error, it may be because the user simply does not have the correct View permissions on the object you are trying to access :-) There may not be a deeper problem :-) Check and double check.