Difference: TWikiAccessControl (17 vs. 18)

Revision 1814 Sep 2001 - PeterThoeny

Line: 1 to 1
 

Warning: Can't find topic TWiki.UtilTempDocNote

Line: 10 to 10
 

Overview

Changed:
<
<		TWikiAccessControl allows you restrict access to single topics and entire webs, by individual user and by user groups, in three main areas: view; edit & attach; and rename/move/delete. These controls, combined with TWikiUserAuthentication, let you easily create and manage an extremely flexible, fine-grained privilege system.
>
>		TWikiAccessControl allows you restrict access to single topics and entire webs, by individual user and by user groups, in three main areas: view; edit & attach; and rename/move/delete. These controls, combined with TWikiUserAuthentication, let you easily create and manage an extremely flexible, fine-grained privilege system.
 

An Important Control Consideration

Changed:
<
<		Open, freeform editing is the essence of the WikiCulture - it's what makes TWiki different and often more effective than other collaboration tools. So, it is strongly recommended that decisions to restrict read or write access to a web or a topic are made with care. Experience shows that unrestricted write access works very well because:
>
>		Open, freeform editing is the essence of the WikiCulture - it's what makes TWiki different and often more effective than other collaboration tools. So, it is strongly recommended that decisions to restrict read or write access to a web or a topic are made with care. Experience shows that unrestricted write access works very well because:
 
  • Peer influence is enough to ensure that only relevant content is posted.

  • Peer editing - the ability to rearrange anything on a page - keeps topics focussed.

  • All content is preserved under revision control.
Changed:
<
<
>
>
    • Edits can be undone by the TWikiAdminGroup (the default administrators group; see #ManagingGroups).
 
    • Users are encouraged to edit and refactor (condense a long topic), since there's a safety net.

As a collaboration guideline:

Line: 35 to 35
 

Managing Users

Changed:
<
<		A user is created by with the TWikiRegistration form. The process generates a topic in the Main web in the new user's WikiName. The default visitor name is TWikiGuest.
>
>		A user is created by with the TWikiRegistration form. The process generates a topic in the Main web in the new user's WikiName. The default visitor name is TWikiGuest.
 
Changed:
<
<
  • Users can be authenticated using Basic Authentication or SSL. Authentication is required in order to track user identities.
>
>
  • Users can be authenticated using Basic Authentication or SSL. TWikiUserAuthentication is required in order to track user identities.
 

Managing Groups

Line: 123 to 123
 

Known Issues

  • The view restriction is not suitable for very sensitive content since there is a way to circumvent the read access restriction.
Changed:
<
<
  • Read access restriction only works if the view script is authenticated, that means that users need to log on also just to read topics. TWiki Installation Guide has more on Basic Authentication based on the .htaccess file.
>
>
  • Read access restriction only works if the view script is authenticated, that means that users need to log on also just to read topics. TWikiInstallationGuide has more on Basic Authentication based on the .htaccess file.
 

Selective Unrestricted Web Access

  • There is a workaround if you prefer to have unrestricted access to view topics located in normal webs, and to authenticate users only for webs where view restriction is enabled:
    1. Omit the view script from the .htaccess file.
Changed:
<
<
    1. Enable the $doRememberRemoteUser flag in lib/wikicfg.pm as described in User Authentication. TWiki will now remember the IP address of an authenticated user.
>
>
    1. Enable the $doRememberRemoteUser flag in lib/TWiki.cfg as described in TWikiUserAuthentication. TWiki will now remember the IP address of an authenticated user.
 
    1. Copy the view script to viewauth (or better, create a symbolic link)
    2. Add viewauth to the list of authenticated scripts in the .htaccess file.
      • When a user accesses a web where you enabled view restriction, TWiki will redirect from the view script to the viewauth script once (this happens only if the user has never edited a topic). Doing so will ask for authentication. The viewauth script shows the requested topic if the user could log on and if the user is authorized to see that web.
View topic | History: r36 < r35 < r34 < r33 | More topic actions...
 
This site is powered by the TWiki collaboration platformCopyright � by the contributing authors. All material on this collaboration platform is the property of the contributing authors.
Ideas, requests, problems regarding TWiki? Send feedback
Note: Please contribute updates to this topic on TWiki.org at TWiki:TWiki.TWikiAccessControl