On Sun, Feb 19, 2012 at 7:26 PM, Heiko Schlittermann <hs@schlittermann.de> wrote:

Bashar <bashar@gmail.com> (So 19 Feb 2012 14:22:21 CET):

> Hello,
> We're using Pound as front for Zope and in Z2.log it shows the main IP of
> Pound that forwards traffic.
>
> I wish to use the Domains feature under acl_users in zope to restrict
> access for managers (the /manage) So how can i change/tweak it where Zope
> can see the real user IP for using it in Domains option for managers?

As Pound acts an a proxy on the application protocol layer, Zope will
see connections originating from the Pound proxy only.

But - Pound sets the X-Forwarded-For HTTP-Header.

GET /test/index.html HTTP/1.0
User-Agent: Wget/1.12 (linux-gnu)
Accept: */*
Host: ssl.schlittermann.de
X-SSL-cipher: DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1
X-Forwarded-For: 88.73.219.244

But - you should read about X-Forwarded-For and possibilities of its
abuse and about its contents in face of proxy chains.

I do not know anything about Zope, but probably you can have it trust
the X-Forwarded-For headers and apply its ACLs on the base of these
headers.