wiki:WikiRbacPatch

Version 10 (modified by anonymous, 6 years ago) (diff)

--

Role-Based Access Control for the Trac Wiki

Description

WikiRBAC modifies the trac.wiki.web_ui component to enforce Role-Based Access Control on the wiki. Roles are configured as groups within the subversion authz file and ACLs are specified identically to subversion permissions, with the addition of 'c', and 'd' options, which control creation and deletion permissions respectively.

See also AuthzWebadminPlugin

Note

As of [382], WikiRBAC can not increase a user's permissions. It can only limit them. That is, if user jru does not have WIKI_MODIFY permission, then telling WikiRBAC to let him modify some page or subwiki will not work. The user jru must have WIKI_MODIFY permission and WikiRBAC authorization in order to modify a page or subwiki.
WIKI_ADMIN permission overrides all WIKI_RBAC checks.

Bugs/Feature Requests

Existing bugs and feature requests for WikiRbacPatch are here.

If you have any issues, create a new ticket.

Download

Download the zipped source from here.

(see #803 for a version of the patch that works with 0.10)

Source

You can check out WikiRbacPatch from here using Subversion, or browse the source with Trac.

Example

Install the patch.
Add the following to trac.ini's [wiki] section:

authz_svn_module_name = tracwiki
authorization_mode = require_all
#authz_file = <path_to_some_authz_file> (optional)

Notes

The authz_svn_module directive specifies which subversion module to masquerade as. Recall that an authz section is of the form [ [module]:path ]. Leaving this empty is a bad idea.
The authorization_mode option tells the wiki authorization subsystem how to behave. Since the module exposes an extension point, plugins can be written to provide other authorization methods -- specifically, those that are not based around Subversion's Authz file. A setting of require_all means that every authorizer must successfully authorize an operation in order for that operation to be authorized. In contrast, require_one (to be renamed to require_any needs at least one authorizer to approve an operation in order that operation be authorized. Not including this directive, or setting it to any other string (such as none) will result in the RBAC system being deactivated.
The authz_file option specifies a path to a file in authz format. This is intended to allow the wiki component to get its authorization from a different file than Subversion's authz, or to provide an authz file when Subversion is not being used. Just as an example, one might add to the subversion authz file (or set the authz_file directive in the wiki section to something appropriate):

[groups]
example = mrfoo,mrsbaz
losers = somedude

[tracwiki:/]
* = r #give everyone read access

[tracwiki:/WikiStart]
@example = rw #give read/write permission to the example group.

[tracwiki:/somepath/sample]
@losers = rwcd #give the losers group authorization to read, edit, create, and delete wiki pages.

Please note that Trac's own prefix, /wiki, has not to be included as it is silently assumed.

Recent Changes

[634] by puffy on 2006-04-09 21:08:54
WikiRbacPatch:

Integrate heinlein@…'s modifications (see ticket #221) to get WikiRBAC to apply on > 0.9.2.

[388] by puffy on 2006-01-20 20:41:21
WikiRbacPatch:

Fix the calling semantics on WikiAuthorizer so it takes a permission system rather than a request.

[382] by puffy on 2006-01-20 14:46:32
WikiRbacPatch:

Initial import of the WikiRBAC patch.

Author/Contributors

Author: puffy
Contributors:

TagIt(patch,puffy,alpha,unsupported,0.9)?