You now have a web script that returns all Whitepapers, and a web script that returns the rating summary for a specific Whitepaper. The next step is to implement a web script that supports the POST method so that people can submit new ratings.

Like all web scripts, the web script that creates ratings will run as the user executing the script. In this case, you are appending Guest=True to the URL and so the web script will run as Guest. But allowing Guest to create data in the repository is not a good idea. That means the web script needs to run as an actual user. One way to handle this would be to set the web script's minimum authentication level to User, give named users (or one or more groups) write access to the Whitepapers folder, and make web site users authenticated. But SomeCo doesn't want to set up user accounts for every user who might rate content. Any user ought to be able to rate content whether or not he or she can authenticate with Alfresco as...