TWiki home TWiki.Tukro > TWiki > TWikiAccessControl (r1.24) TWiki.Tukro webs:
Main | TWiki | Know | Sandbox
TWiki . { Welcome | Register | Changes | Topics | Index | Search | Go }

TWiki Access Control

Restricting read and write access to topics and webs, by Users and groups

TWikiAccessControl allows you restrict access to single topics and entire webs, by individual user and by user Groups, in three areas: view; edit & attach; and rename/move/delete. Access control, combined with TWikiUserAuthentication, lets you easily create and manage an extremely flexible, fine-grained privilege system.

An Important Control Consideration

Open, freeform editing is the essence of WikiCulture - what makes TWiki different and often more effective than other collaboration tools. For that reason, it is strongly recommended that decisions to restrict read or write access to a web or a topic are made with care - the more restrictions, the less Wiki in the mix. Experience shows that unrestricted write access works very well because:

As a collaboration guideline:

Users and Groups

Access control is based on the familiar concept of Users and Groups. Users are defined by their WikiNames. They can then be organized in unlimited combinations by inclusion in one or more user Groups. For convenience, Groups can also be included in other Groups.

Managing Users

A user is created with the TWikiRegistration form. The process generates a topic in the Main web in the new user's WikiName. The default visitor name is TWikiGuest.

Managing Groups

Groups are defined by group topics created in the Main web, like the TWikiAdminGroup. To create a new group:

  1. Edit TWikiGroups by entering a new topic with a name that ends in Group. Example:
  2. Set Preferences for two Variables in the new group topic:

Restricting Write Access

You can define who is allowed to make changes to a web or a topic.

Deny Editing by Topic

Denying editing of a topic also restricts file attachment; both privileges are assigned together.

Deny Editing by Web

Restricting web-level editing blocks creating new topics, changing topics or attaching files.

The same rules apply as for restricting topics, with these additions:

Restricting Rename Access

You can define who is allowed to rename, move or delete a topic, or rename a web.

Deny Renaming by Topic

To allow a user to rename, move or delete a topic, they also need write (editing) permission. They also need write access to change references in referring topics.

Deny Renaming by Web

You can define restrictions of who is allowed to rename a TWiki.Tukro web.

The same rules apply as for topics, with these additions:

Restricting Web Access

You can prevent selected Users and Groups from accessing certain webs, by hiding them using restricting read access, or by requiring login. There are two basic methods, one simple, using standard preferences variables to hide a web, but offering low security, and a secure log-in approach that is currently a workaround, involving some minor script and filesystem modification.

Create Hidden Webs

You can prevent selected Users and Groups from viewing certain TWiki.Tukro webs by setting one or both of these variables in each web's WebPreferences topic:

TIP If keeping a hidden web out of general use is a consideration, you can prevent the all webs search option from accessing hidden webs, by enabling the NOSEARCHALL variable in WebPreferences:

ALERT! Hiding webs is not very secure, as there is a way to circumvent the read access restriction. It can be useful in certain situations - for example, to simplify site organization and clutter, by hiding low traffic webs - but is not recommended for securing sensitive content. (See the next section for a more secure approach.)

Create Authenticated Access By Web

Use the following setup to provide unrestricted viewing access to open webs, with authentication only on selected webs:

  1. Omit the view script from the .htaccess file.
  2. Enable the $doRememberRemoteUser flag in lib/TWiki.cfg as described in TWikiUserAuthentication. TWiki.Tukro will now remember the IP address of an authenticated user.
  3. Copy the view script to viewauth (or better, create a symbolic link)
  4. Add viewauth to the list of authenticated scripts in the .htaccess file.

Hiding Control Settings

<!--

The SuperAdminGroup

By mistyping a user or group name in the ALLOWTOPICCHANGE setting, it's possible to lock a topic so that no-one can edit it from a browser. To avoid this, you can create Web-based superusers:

$superAdminGroup = "TWikiAdminGroup";

-- PeterThoeny - 04 May 2002
-- MikeMannix? - 12 May 2002


Topic TWikiAccessControl . { Edit | Attach | Ref-By | Printable | Diffs | r1.28 | > | r1.27 | > | r1.26 | More }
Revision r1.24 - 12 May 2002 - 11:34 - MikeMannix? Copyright © 1999-2024 by the contributing authors. All material on this collaboration platform is the property of the contributing authors.
Ideas, requests, problems regarding TWiki.Tukro? Send feedback.