first commit

en/wiki/wikilib.d/PmWiki.AuthUser

@@ -0,0 +1,9 @@
+version=pmwiki-2.2.74 ordered=1 urlencoded=1
+author=Petko
+charset=UTF-8
+csum=pmcrypt
+name=PmWiki.AuthUser
+rev=191
+targets=PmWiki.Passwords,PmWiki.ThoughtsOnAccessControl,Cookbook.QuickStartForAuthUser,PmWiki.PasswordsAdmin,SiteAdmin.AuthUser,PmWiki.AuthUser,Cookbook.AuthUserViaMicrosoftLDAP,Cookbook.AuthUser,Cookbook.UserLastAction,PITS.00400,Cookbook.HtpasswdForm
+text=(:Summary:Authorization system that uses usernames and passwords:)%0a(:Audience: administrators (intermediate) :)%0aAuthUser is PmWiki's identity-based authorization system that allows access to pages to be controlled through the use of usernames and passwords.  AuthUser can be used in addition to the [[Passwords | password-based]] scheme that is PmWiki's default configuration.%0a%0aAuthUser is a very flexible system for managing access control on pages, but flexibility can also bring complexity and increased maintenance overhead to the wiki administrator.  This is why PmWiki defaults to the simpler password-based system.  For some thoughts about the relative merits of the two approaches, see [[PmWiki:ThoughtsOnAccessControl]].%0a%0aSee also:  [[Cookbook:Quick Start for AuthUser]].%0a%0a!! Activating AuthUser%0aTo activate PmWiki's identity-based system, add the following line%0ato ''local/config.php'':%0a%0a    include_once("$FarmD/scripts/authuser.php");%0a%0aEnsure that you have [[PasswordsAdmin | set a site wide admin password]], otherwise you will not be able to edit [[SiteAdmin.AuthUser]].%0a%0a->%25note%25 Note: Older versions of PmWiki (before 2.2.0-beta58) use ''Site.AuthUser''.%0a%0aPmWiki caches some group and page authorization levels when a page is accessed. For this reason, it is better to include @@authuser.php@@ quite early in config.php, notably%0a* after any recipe which inserts some custom writable PageStore class (MySQL, SQLite, Compressed PageStore or other)%0a* and after any internationalization (UTF-8 and XLPage).%0a%0a(If you don't use a custom PageStore class and i18n, include @@authuser.php@@ first thing in @@config.php@@.)%0a%0aAll other recipes should be included after these.%0a%0a!! Creating user accounts%0aMost of AuthUser's configuration is performed via the [[SiteAdmin.AuthUser]] page.  To change the AuthUser configuration, simply edit this page like any other wiki page (you'll typically need to use the site's admin password for this).%0a%0aTo create a login account, simply add lines to SiteAdmin.AuthUser that look like:%0a%0a    username: [=(:=]encrypt ''password'':)%0a%0aFor example, to create a login account for "alice" with a password of "wonderland", enter:%0a%0a    alice: [=(:=]encrypt wonderland:)%0a%0aWhen the page is saved, the "@@[=(:=]encrypt wonderland:)@@" part of the text will be replaced by an encrypted form of the password "wonderland".  This encryption is done so that someone looking at the SiteAdmin.AuthUser page cannot easily determine the passwords stored in the page.  %0a%0aTo change or reset an account's password, simply replace the encrypted string with another @@[=(:=]encrypt:)@@ directive.%0a%0a%25note%25 The password cannot contain spaces, tabs, new lines, columns ":" and equals "="; on some systems it should contain at least 4 characters. Usernames and passwords are case sensitive, eg. "User" is not the same as "user".%0a%0a!! Controlling access to pages by login%0a%0aPages and groups can be protected based on login account by using "passwords" of the form [@id:username@] in the password fields of [@?action=attr@] (see [[PmWiki.Passwords]]).  For example, to restrict a page to being edited by Alice, one would set the password to "[@id:alice@]".%0a%0aIt's possible to use multiple "id:" declarations and passwords in the [@?action=attr@] form, thus the following setting would allow access to Alice, Carol, and anyone who knows the password "quick":%0a%0a    quick id:alice,carol%0a%0aTo allow access to anyone who has successfully logged in, use "[@id:*@]".%0a%0aOne can also perform site-wide restrictions based on identity in the $DefaultPasswords array: e.g.%0a%0a    # require valid login before viewing pages%0a    $DefaultPasswords['read'] = 'id:*';%0a    # Alice and carol may edit%0a    $DefaultPasswords['edit'] = 'id:alice,carol';%0a    # All admins and Fred may edit%0a    $DefaultPasswords['edit'] = array('@admins', 'id:Fred');%0a%0aYou can change the $DefaultPasswords array in local customization files such as:%0a* local/config.php (for entire wiki)%0a* farmconfig.php (for entire wikifarm)%0a%0a!! [[#auth_groups]] Organizing accounts into groups%0a%0aAuthUser also makes it possible to group login accounts together into authorization groups, indicated by a leading "@" sign.  As with login accounts, group memberships are maintained by editing the SiteAdmin.AuthUser page.  Group memberships can be specified by either listing the groups for a login account (person belongs to groups) or the login accounts for a group (group includes people).  You can repeat or mix-and-match the two kinds as desired:%0a%0a    @writers: alice, bob%0a    carol: @writers, @editors%0a    @admins: alice, dave%0a    %0aThen, to restrict page access to a particular group, simply use "[@@group@]" as the "password" in [@?action=attr@] or the $DefaultPasswords array, similar to the way that "[@id:username@]" is used to restrict access to specific login accounts.%0a%0a!!! ExclLine truncated
+time=1430064860