TWiki Access Control

Restricting read and write access to topics and webs, by users and groups

Overview

TWikiAccessControl allows you restrict access to single topics and entire webs, by individual user and by user groups, in three main areas: view; edit & attach; and rename/move/delete. These controls, combined with TWikiUserAuthentication, let you easily create and manage an extremely flexible, fine-grained privilege system.

An Important Control Consideration

Open, freeform editing is the essence of the WikiCulture - it's what makes TWiki different and often more effective than other collaboration tools. So, it is strongly recommended that decisions to restrict read or write access to a web or a topic are made with care. Experience shows that unrestricted write access works very well because:

As a collaboration guideline:

Users and Groups

Access control is based on users and groups. Users are defined by their WikiNames, an then organized into unlimited combinations under different user groups.

Managing Users

A user is created by with the TWikiRegistration form. The process generates a topic in the Main web in the new user's WikiName. The default visitor name is TWikiGuest?.

Managing Groups

Groups are defined by group topics in the Main web, like the TWikiAdminGroup. To start a new group:

  1. Create a new topic with A name that ends in Group, SomeGroup
  2. Define two variables:
    • Set GROUP = < list of users and groups >
    • Set ALLOWTOPICCHANGE = < list of users and groups >

Restricting Write Access

You can define who is allowed to make changes to a web or a topic.

Deny Editing by Topic

Denying editing of a topic also restricts attaching files to it; both privileges are assigned together.

Deny Editing by Web

Restricting web-level editing blocks creating new topics, changing topics or attaching files.

The same rules apply as for restricting topics, with these additions:

Restricting Rename Access

You can define who is allowed to rename, move or delete a topic, or rename a web.

Deny Renaming by Topic

To allow a user to rename, move or delete a topic, they also need write (editing) permission. They also need write access to change references in referring topics.

Deny Renaming by Web

You can define restrictions of who is allowed to rename a netfrag.org web.

The same rules apply as for topics, with these additions:

Restricting Read Access

You can define restrictions of who is allowed to view a netfrag.org web.

Known Issues

Selective Unrestricted Web Access

Hiding Control Settings

<!--
Set DENYTOPICCHANGE = Main.SomeGroup
-->

The SuperAdminGroup

By mistyping a user or group name in the ALLOWTOPICCHANGE setting, it's possible to lock a topic so that it no-one can edit it from a browser. To avoid this:

$superAdminGroup = "TWikiAdminGroup";

-- MikeMannix? - 02 Dec 2001