thanks for the great help, I'm amazed at how responsive the Zimbra team is
penrose should do the trick
we actually also have a small wiki/knowledgebase app for sharing docs, semi structured data, etc. - it provides a pluggable auth layer (it can use an LDAP store, etc.), and we already have a RBAC model in the db, but Penrose looks to be the simplest route to exposing this model to Zimbra - no migrations, and everything is still in the db |