1. Use Basic Authentication (.htaccess) to control access by protecting key scripts: attach, edit=, installpasswd, preview, rename, save, upload using the .htaccess file. The TWikiInstallationGuide has step-by-step instructions.

TWiki User Authentication

Overview

Authentication Options

Partial Authentication

TWiki Username vs. Login Username

Changing Passwords

1. Forget about authentication to make your site completely public - anyone can browse and edit freely, in classic Wiki mode. All visitors are assigned the TWikiGuest^? default identity, so you can't track individual user activity.
   
2. Use SSL (Secure Sockets Layer; HTTPS) to authenticate and secure the whole server.
   
3. Use Basic Authentication (HTAccess) to control access by protecting key scripts: attach, edit=, installpasswd, password, preview, rename, save, upload, view, viewfile using .htaccess files. The TWiki Installation Guide has step-by-step instructions.

Partial Authentication

• Normally, the REMOTE_USER environment variable is set for the scripts that are under authentication. If, for example, the edit, save and preview scripts are authenticated, but not view, you would get your WikiName in preview for the %WIKIUSERNAME% variable, but view will show TWikiGuest instead of your WikiName.

• TWiki can be configured to remember the IP address/username pair whenever an authentication happens (edit topic, attach file). Once remembered, the non-authenticated scripts, like view, will show the correct username instead of TWikiGuest^?.

• Enable this feature by setting the $doRememberRemoteUser flag in TWiki.cfg. TWiki then persistently stores the IP address/username pairs in the file, $remoteUserFilename, which is "$dataDir/remoteusers.txt" by default.

• NOTE: This approach can fail if the IP address changes due to dynamically assigned IP addresses or proxy servers.

Quick Authentication Test - Use the %WIKIUSERNAME% variable to return your current identity:

• You are TWikiGuest^?

• The ChangePassword form ( TWiki/ChangePassword ):

• The ResetPassword form ( TWiki/ResetPassword ):

1. Forget about authentication. All changes are registered to TWikiGuest^? user, so you can't tell who made changes. Your site is completely open and public - anyone can browse and edit freely, in classic Wiki mode.
   
2. Use Basic Authentication for the edit and attach scripts. This uses .htaccess and generates the familiar grey log-in window. The TWiki Installation Guide has step-by-step instructions.
   
3. Use SSL to authenticate and secure the whole server.

• The ChangePassword form, TWiki/ChangePassword:

• The ResetPassword form TWiki/ResetPassword:

Forgot your old password? Then use ResetPassword instead. Please only use ResetPassword in case you really forgot your password. Thank you.

After submitting this form your password will be changed.

Request for reset of password

Please only use this ResetPassword form in case you really forgot your password. Otherwise just change it using ChangePassword. Thank you.

After submitting this form you will receive a page with yor new password appearing encrypted.

Changing Passwords

Overview

TWiki does not authenticate users internally, it depends on the REMOTE_USER environment variable. This variable is set when you enable Basic Authentication (.htaccess) or SSL "secure server" authentication (https protocol).

1. Forget about authentication. All changes are registered to TWikiGuest^? user, so you can't tell who made changes. Your site is completely open and public - anyone can browse and edit freely, in classic Wiki mode.
   
2. Use Basic Authentication for the edit and attach scripts. This uses .htaccess and generates the familiar grey log-in window. The TWiki Installation Guide has step-by-step instructions.
   

TWiki User Authentication

Authentication Options

1. Forget about authentication. All changes are registered to TWikiGuest^? user, so you can't tell who made changes. Your site is completely open and public.
2. Use Basic Authentication for the edit and attach scripts. This uses .htaccess and generates the familiar grey log-in window. TWiki Installation Notes has more.
3. Use SSL to authenticate and secure the whole server.

Tracking by IP Address

There is a way to tell TWiki to remember the user for the scripts that are not authenticated, ex: in case the REMOTE_USER environment variable is not set. TWiki can be configured to remember the IP address/username pair whenever an authentication happens (edit topic, attach file). Once remembered, the non-authenticated scripts like view will show the correct username instead of TWikiGuest. You can enable this by setting the $doRememberRemoteUser flag in TWiki.cfg. TWiki persistently stores the IP address / username pairs in file $remoteUserFilename, which is "$dataDir/remoteusers.txt" by default. Please note that this can fail if the IP address changes due to dynamically assigned IP addresses or proxy servers.

Authentication Test: You are TWikiGuest^? (%WIKIUSERNAME%)

TWiki Username vs. Login Username

This section applies only if your netfrag.org is installed on a server that is both authenticated and on an intranet.

netfrag.org internally manages two usernames: Login username and TWiki username.

• Login username: When you login to the intranet, you use your existing login username, ex: pthoeny. This name is normally passed to netfrag.org by the REMOTE_USER environment variable, and used by internally by netfrag.org. Login usernames are maintained by your system administrator.
• TWiki username: Your name in WikiNotation, ex: PeterThoeny, is recorded when you register using TWikiRegistration; doing so also generates a personal home page in the Main web.

netfrag.org can automatically map an intranet username to a TWiki username, provided that the username pair exists in the TWikiUsers topic. This is also handled automatically when you register.

NOTE: To correctly enter a WikiName - your own or someone else's - be sure to include the Main web name in front of the Wiki username, followed by a period, and no spaces. Ex:

Main.WikiUsername or %MAINWEB%.WikiUsername

This points WikiUser to the netfrag.org.Main web, where user registration pages are stored, no matter which web it's entered in. Without the web prefix, the name appears as a NewTopic^? everywhere but in the Main web.

TWiki Authentication

TWiki does not authenticate users internally, it depends on the REMOTE_USER environment variable. This variable is set when you enable basic authentication or authentication via SSL (https protocol)

• Use basic authentication for the edit and attach scripts. TWiki Installation Notes tells you more about that.

There is a way to tell TWiki to remember the user for the scripts that are not authenticated, e.g. for the case where the REMOTE_USER environment variable is not set. TWiki can be configured to remember the IP address / username pair whenever an authentication happens (edit topic, attach file). Once remembered, the non authenticated scripts like view will show the correct username instead of TWikiGuest. You can enable this by setting the $doRememberRemoteUser flag in TWiki.cfg. TWiki persistently stores the IP address / username pairs in file $remoteUserFilename, which is "$dataDir/remoteusers.txt" by default. Please note that this can fail in case the IP address changes due to dynamically assigned IP addresses or proxy servers.

TWiki keeps track who made changes to topics at what time. This gives a complete audit trail of changes.

No special installation steps need to be performed in case the server is already autenticated. If not you can opt for one of these:

• Forget about authentication. All changes will be registered as TWikiGuest^? user, e.g. you can't tell who made changes.
• Use basic authentication for the edit and attach scripts. TWiki Installation tells you more about that.
• Use SSL to authenticate and secure the whole server.

The REMOTE_USER environment variable is only set for the scripts that are under authentication. If for example the edit, save and preview scripts are authenticated, but not view, you would get your WikiName in preview for the %WIKIUSERNAME% variable, but view will show TWikiGuest instead of your WikiName.

There is a way to tell TWiki to remember the user for the scripts that are not authenticated, e.g. for the case where the REMOTE_USER environment variable is not set. TWiki can be configured to remember the IP address / username pair whenever an authentication happens (edit topic, attach file). Once remembered, the non authenticated scripts like view will show the correct username instead of TWikiGuest. You can enable this by setting the $doRememberRemoteUser flag in wikicfg.pm. TWiki persistently stores the IP address / username pairs in file $remoteUserFilename, which is "$dataDir/remoteusers.txt" by default. Please note that this can fail in case the IP address changes due to dynamically assigned IP addresses or proxy servers. Test: You are TWikiGuest^?.

-- PeterThoeny^? - 02 Nov 2000