Difference: TWikiAccessControl (15 vs. 16)

Revision 162001-09-07 - MikeMannix

Line: 1 to 1
 
On this page:
Changed:
<
<

TWiki Access Control

>
>

TWiki Access Control

  Restricting read and write access to topics and webs, by users and groups
Changed:
<
<

Overview

>
>

Overview

  TWikiAccessControl allows you restrict access to single topics and entire webs, by individual user and by user groups, in three main areas: view; edit & attach; and rename/move/delete. These controls, combined with TWikiUserAuthentication, let you easily create and manage an extremely flexible, fine-grained privilege system.
Changed:
<
<

An Important Control Consideration

>
>

An Important Control Consideration

  Open, freeform editing is the essence of the WikiCulture - it's what makes TWiki different and often more effective than other collaboration tools. So, it is strongly recommended that decisions to restrict read or write access to a web or a topic are made with care. Experience shows that unrestricted write access works very well because:
Line: 27 to 27
 
  • Create broad groups (more and varied input), and...
  • Avoid creating view-only users (if you can read it, you can contribute to it).
Changed:
<
<

Users and Groups

>
>

Users and Groups

  Access control is based on users and groups. Users are defined by their WikiNames, an then organized into unlimited combinations under different user groups.
Changed:
<
<

Managing Users

>
>

Managing Users

  A user is created by with the TWikiRegistration form. The process generates a topic in the Main web in the new user's WikiName. The default visitor name is TWikiGuest.

  • Users can be authenticated using Basic Authentication or SSL. Authentication is required in order to track user identities.

Changed:
<
<

Managing Groups

>
>

Managing Groups

  Groups are defined by group topics in the Main web, like the TWikiAdminGroup. To start a new group:
  1. Create a new topic with A name that ends in Group, SomeGroup
Line: 51 to 51
 
    • ALLOWTOPICCHANGE defines who is allowed to change the group topic; it is a comma delimited list of users and groups. You typically want to restrict that to the members of the group itself, so it should contain the name of the topic,
          * Set ALLOWTOPICCHANGE = Main.TWikiAdminGroup
      for the TWikiAdminGroup topic. (This prevents users not in the group from editing the topic and from gaining unauthorized membership to the group.)
Changed:
<
<

Restricting Write Access

>
>

Restricting Write Access

  You can define who is allowed to make changes to a web or a topic.
Changed:
<
<

Deny Editing by Topic

>
>

Deny Editing by Topic

  Denying editing of a topic also restricts attaching files to it; both privileges are assigned together.
  • Define one or both of these variables in a topic, preferably at the end of the page:
Line: 68 to 68
 
  • DENYTOPICCHANGE is evaluated before ALLOWTOPICCHANGE. Access is denied if the authenticated person is in the DENYTOPICCHANGE list, or not in the ALLOWTOPICCHANGE list. Access is granted in case DENYTOPICCHANGE and ALLOWTOPICCHANGE is not defined.
Changed:
<
<

Deny Editing by Web

>
>

Deny Editing by Web

  Restricting web-level editing blocks creating new topics, changing topics or attaching files.
Line: 80 to 80
 
  • DENYTOPICCHANGE (in topic) overrides DENYWEBCHANGE (in WebPreferences)
  • ALLOWTOPICCHANGE (in topic) overrides ALLOWWEBCHANGE (in WebPreferences)
Changed:
<
<

Restricting Rename Access

>
>

Restricting Rename Access

  You can define who is allowed to rename, move or delete a topic, or rename a web.
Changed:
<
<

Deny Renaming by Topic

>
>

Deny Renaming by Topic

  To allow a user to rename, move or delete a topic, they also need write (editing) permission. They also need write access to change references in referring topics.
Line: 98 to 98
 
  • DENYTOPICRENAME is evaluated before ALLOWTOPICRENAME. Access is denied if the authenticated person is in the DENYTOPICRENAME list, or not in the ALLOWTOPICRENAME list. Access is granted in case DENYTOPICRENAME and ALLOWTOPICRENAME is not defined.
Changed:
<
<

Deny Renaming by Web

>
>

Deny Renaming by Web

  You can define restrictions of who is allowed to rename a TWiki web.
Line: 110 to 110
 
  • DENYTOPICRENAME (in topic) overrides DENYWEBRENAME (in WebPreferences)
  • ALLOWTOPICRENAME (in topic) overrides ALLOWWEBRENAME (in WebPreferences)
Changed:
<
<

Restricting Read Access

>
>

Restricting Read Access

  You can define restrictions of who is allowed to view a TWiki web.
Line: 118 to 118
 
    • Set DENYWEBVIEW = < list of users and groups >
    • Set ALLOWWEBVIEW = < list of users and groups >
Changed:
<
<

Known Issues

>
>

Known Issues

 
  • The view restriction is not suitable for very sensitive content since there is a way to circumvent the read access restriction.
  • Read access restriction only works if the view script is authenticated, that means that users need to log on also just to read topics. TWiki Installation Guide has more on Basic Authentication based on the .htaccess file.
Changed:
<
<
Selective Unrestricted Web Access
>
>

Selective Unrestricted Web Access

 
  • There is a workaround if you prefer to have unrestricted access to view topics located in normal webs, and to authenticate users only for webs where view restriction is enabled:
    1. Omit the view script from the .htaccess file.
Line: 136 to 136
 
      • It is not recommended to restrict view access to individual topics since all content is searchable within a web.

Changed:
<
<

The SuperAdminGroup

>
>

The SuperAdminGroup

  By mistyping a user or group name in the ALLOWTOPICCHANGE setting, it's possible to lock a topic so that it no-one can edit it from a browser. To avoid this:
  • Set the $superAdminGroup variable in lib/TWiki.cfg to the name of a group of users that are always allowed to edit/view topics.
View topic | History: r44 < r43 < r42 < r41 | More topic actions...
 
This site is powered by the TWiki collaboration platform Powered by PerlCopyright © 1999-2024 by the contributing authors. All material on this collaboration platform is the property of the contributing authors.
Ideas, requests, problems regarding TWiki? Send feedback
Note: Please contribute updates to this topic on TWiki.org at TWiki:TWiki.TWikiAccessControl.