Creating a multi-tier client/server application

[Jeff]

Hello everyone.  I've searched through the archives here, and it seems
that questions similar to this one have come up in the past, but I was
hoping that I could pick your Pythonic brains a bit.

Here's a broad overview of what I need to do:  cross-platform, client-
side GUI apps that interact with a server backed by a database.  I'd
also like the possibility of having a web interface for small portions
of the app.  It will be a fairly complex system for managing personnel
(and training, performance reviews, etc.) and payroll, and I will
probably have about a year or more to write it.

None of this is written yet--actually, it's not even to the point of
specs yet, I'm just trying to learn the best way to do this *before* I
get to the specs.  I want to plan this application out as thoroughly
as possible before writing any code, and I want to do it The Right
Way(TM), hence I have (hopefully) convinced my manager (and clients)
that Python is the way to go.  I have a couple years of experience in
Python, but it's mostly been web apps (which I am thoroughly sick of
making, thanks to PHP) and simple CLI programs.  Not sure if any of
that information helps, but I'm tired, so please bear with me.

The application definitely needs at least three tiers: client, server,
and DB.  I want as little logic in the client as possible (if not
none), as there will be sensitive data in the DB.  I also can't have
the clients connect to the DB directly, as it will need to only accept
connections on the local host.  The client will probably be installed
on 50-100 machines, and will be used by several hundred people (yes,
they're sharing machines--the users will be computer lab consultants/
server operators/helpdesk employees, etc. and their supervisors), so
authentication (using LDAP) and authorization (using groups I will
define) will be very important.  Also important will be automatic
updates of the client, which I figure I'll do by comparing version
numbers, then downloading an archive (egg, maybe?) of the latest
(compiled? byte-?) code.

I will probably make the GUI in wxPython, as that seems to be most
flexible and nicely cross-platform choice--but I am open to
suggestions.  Not too worried about that one, though.

For the database, I'll use Postgres, because I love Postgres.
Probably not going to budge on that one unless anyone has any good
reasons to.  I'd also like to use SQLAlchemy (because it is so nice),
but this is not a requirement (I can write SQL, but... SQLAlchemy is
so nice.)  I'd like to use an ORM mainly because it would facilitate
code reuse for the (very simple) web interface, and other offshoot
tools down the line.

So, my real question (sorry for the all the exposition) is this: how
to do the networking?  I'd really like to have the client send a
simple request to the server along the lines of "fetch this (or these)
object(s)", or "update this value in this object", then let the server
decide if the user actually is allowed to do so, and then make the
change in the database.

My first thought was XML-RPC, because I've used it before, and it is
so nice and clean--but then I can't send objects, which is really
rather crucial.

Then I looked at Pyro, which seems awesome, but I'm confused as to how
(if possible) I would use it with a DB.  Would I have to figure out on
the client what SQL query to send to get the right objects? That would
kind of kill the separation of logic.  And would it work at all with
SQLAlchemy (or any ORM for that matter)?

I looked at SOAP.  It made me feel unclean.  I looked at some CORBA,
at which point my eyes glazed over (possibly not CORBA's fault, I will
look at it again later).

I checked out Twisted, but there are so vastly many parts to it, that
I'm not sure where to even start.

I'm not ruling out writing my own simple protocol, but it seems like
I'd be reinventing a wheel that's already been reinvented countless
times.

So, all that said--any advice on how to do the networking?  And on the
auto-update?  For that matter, any advice on anything I've mentioned
(or haven't?)  Please feel free to ask me to clarify anything, or tell
me if I'm being an idiot about anything.

Thanks,
Jeff