Changes between Version 6 and Version 7 of LdapPlugin

Timestamp:

Jan 2, 2006, 11:50:03 PM (18 years ago)

Author:

Emmanuel Blot

Comment:

Add info for 0.3.0 new feature: per-environment permissions

LdapPlugin

@@ -129 +129 @@
 # password for authenticated store bind
 store_passwd =
+# global permissions (vs. per-environment permissions)
+global_perms = false
 }}}
 
@@ -287 +289 @@
 your LDAP directory.
 
+=== Global vs. Environment permissions ===
+
+Starting from release '''v0.3.0''', permissions are not defined globally (unless `global_perms` is set in the environment configuration file), but on per-environment basis.
+
+With environment-wide permissions, it is now possible to define distinct permissions for each Trac environment (as long as their name differ) even if they access the same LDAP directory.[[BR]]
+
+The Trac LDAP permission attribute value are prefixed with the environment name.[[BR]]
+Using the previous example, assuming the environment name is named "test", permission attributes would become:
+{{{
+dn: uid=courtney,dc=example,dc=org
+objectclass: user
+objectclass: trac
+tracperm: test:TICKET_VIEW
+tracperm: test:REPORT_CREATE
+tracperm: test:REPORT_VIEW
+}}}
+
+It is still possible to use global permissions by setting in the `[ldap]` section of the environment configuration file:
+{{{
+global_perms = true
+}}}
+
+When a directory contains global permission directives, those permissions apply on every Trac environment accessing the LDAP directory, whichever the `global_perms` value. However, permissions are always created using the current environment permission setting.
+
+From the administrative point of view (`trac-admin`, [http://projects.edgewall.com/trac/wiki/WebAdmin WebAdmin], ...), there are no changes: permission are defined and retrieved as usual.
+
+''Note:'' The environment ''name'' is based on the root directory of the Trac environment. This means that if you use different environment with the same name, such as:
+`/var/local/trac/test` and `/var/db/test`, they are both named "test" and share the same permissions. This is a known limitation of the current implementation.
+
 == Known limitations ==
 
@@ -314 +345 @@
  * '''v0.2.2''': Introduce support for disting DN for users and groups (implemented suggestion described in #75)
  * '''v0.2.3''': Update to support the new boolean parsing introduced in the official Trac trunk
+ * '''v0.3.0''': Introduce per-environment permissions: permissions are defined to the current environment and do not overlap with other Trac environments using the same LDAP directory, unless the `global_perms` configuration parameters is set.
 
 == Author/Contributors ==