D3web: D3web-KnowWE - change user rights for KnowWE

This page (revision-4) was last changed on 16-Oct-2026 11:10 by Albrecht Striffler

This page was created on 08-Nov-2013 11:23 by CarstenWasner

Only authorized users are allowed to rename pages.

Only authorized users are allowed to delete pages.

Page revision history

Version	Date Modified	Size	Author	Changes ...	Change note
4	16-Oct-2026 11:10	1 KB	Albrecht Striffler	to previous	Replace the com.ecyrd example (broken since JSPWiki 2.11) with the shipped policy variants
3	08-Nov-2013 11:23	5 KB	Albrecht Striffler	to previous \| to last
2	18-Dec-2012 14:49	5 KB	Jochen Reutelshöfer	to previous \| to last
1	08-Nov-2013 11:23	5 KB	CarstenWasner	to last

Page References

Incoming links	Outgoing links
D3web-KnowWE - change user rights for KnowWE CarstenWasner D3web-KnowWE - host multiple wikis Tutorial	D3web-KnowWE - change user rights for KnowWE


1	1		!!! d3web-KnowWE - change user rights for KnowWE.
2	2		When working in larger groups, it might be necessary to restrict user access to wikipages.
3	3		This can be done on each wikipage individually, but yields problems like maintainance issues or excessive editing. \\
4	4		A better solution would be to create wiki specific user groups an define access rules.
5	5
6		−	In __${KnowWE-Home}\webapps\KnowWE\WEB-INF\jspwiki.properties activate__\\
7		−	__java.security.policy = $basedir\KnowWEWiki.policy__
	6	+	The access rules are defined in the policy file {{webapps/KnowWE/WEB-INF/jspwiki.policy}}. Which file is used is set by {{jspwiki.policy.file}} in {{WEB-INF/classes/jspwiki-custom.properties}} (relative to the folder {{WEB-INF}} or absolute). The distribution ships these variants:
	7	+	* {{jspwiki.policy}} (default): everyone may view, edit, rename and delete pages. Only suitable for a local installation.
	8	+	* {{jspwiki-readonly.policy}}: everyone may read, logged-in users edit.
	9	+	* {{jspwiki-authonly.policy}}: only logged-in users read and edit.
	10	+	* {{jspwiki-authonly-roles.policy}}: logged-in users read, members of the wiki group ''Editor'' edit.
	11	+	In all of them, members of the wiki group ''Admin'' may do everything. Since everyone can register an account, also consider letting an admin approve new accounts: {{jspwiki.approver.workflow.createUserProfile = Admin}}.
8	12
9		−
10		−	In this policy-file define your specific rules:
	13	+	For own rules, grant permissions to a wiki group, e.g. a group ''myUserGroup'' created in the wiki ({{NewGroup.jsp}}):
11	14		{{{
12		−	EXAMPLE
13		−	// $Id: jspwiki.policy,v 1.23 2007-07-06 10:36:36 jalkanen Exp $
14		−	//
15		−	// This file contains the local security policy for JSPWiki.
16		−	// It provides the permissions rules for the JSPWiki
17		−	// environment, and should be suitable for most purposes.
18		−	// JSPWiki will load this policy when the wiki webapp starts.
19		−	//
20		−	// As noted, this is the 'local' policy for this instance of JSPWiki.
21		−	// You can also use the standard Java 2 security policy mechanisms
22		−	// to create a consolidated 'global policy' (JVM-wide) that will be checked first,
23		−	// before this local policy. This is ideal for situations in which you are
24		−	// running multiple instances of JSPWiki in your web container.
25		−	// To set a global security policy for all running instances of JSPWiki,
26		−	// you will need to specify the location of the global policy by setting the
27		−	// JVM system property 'java.security.policy' in the command line script
28		−	// you use to start your web container. See the documentation
29		−	// pages at http://doc.jspwiki.org/2.4/wiki/InstallingJSPWiki. If you
30		−	// don't know what this means, don't worry about it.
31		−	//
32		−	// Also, if you are running JSPWiki with a security policy, you will probably
33		−	// want to copy the contents of the file jspwiki-container.policy into your
34		−	// container's policy. See that file for more details.
35		−	//
36		−	// ------ EVERYTHING THAT FOLLOWS IS THE 'LOCAL' POLICY FOR YOUR WIKI ------
37		−
38		−	// The first policy block grants privileges that all users need, regardless of
39		−	// the roles or groups they belong to. Everyone can register with the wiki and
40		−	// log in. Everyone can edit their profile after they authenticate.
41		−	// Everyone can also view all wiki pages unless otherwise protected by an ACL.
42		−	// If that seems too loose for your needs, you can restrict page-viewing
43		−	// privileges by moving the PagePermission 'view' grant to one of the other blocks.
44		−
45		−	grant principal com.ecyrd.jspwiki.auth.authorize.Role "All" {
46		−	permission com.ecyrd.jspwiki.auth.permissions.PagePermission ":", "view";
47		−	permission com.ecyrd.jspwiki.auth.permissions.WikiPermission "*", "editPreferences";
48		−	permission com.ecyrd.jspwiki.auth.permissions.WikiPermission "*", "editProfile";
49		−	permission com.ecyrd.jspwiki.auth.permissions.WikiPermission "*", "login";
	15	+	grant principal org.apache.wiki.auth.GroupPrincipal "myUserGroup" {
	16	+	permission org.apache.wiki.auth.permissions.PagePermission ":", "modify,rename";
	17	+	permission org.apache.wiki.auth.permissions.GroupPermission ":", "view";
	18	+	permission org.apache.wiki.auth.permissions.WikiPermission "*", "createPages";
50	19		};
51		−
52		−
53		−	// The second policy block is extremely loose, and unsuited for public-facing wikis.
54		−	// Anonymous users are allowed to create, edit and comment on all pages.
55		−	//
56		−	// Note: For Internet-facing wikis, you are strongly advised to remove the
57		−	// lines containing the "modify" and "createPages" permissions; this will make
58		−	// the wiki read-only for anonymous users.
59		−
60		−	// Note that "modify" implies both "edit" and "upload", so if you wish to
61		−	// allow editing only, then replace "modify" with "edit".
62		−
63		−	grant principal com.ecyrd.jspwiki.auth.authorize.Role "Anonymous" {
64		−	// permission com.ecyrd.jspwiki.auth.permissions.PagePermission ":", "modify";
65		−	// permission com.ecyrd.jspwiki.auth.permissions.WikiPermission "*", "createPages";
66		−	};
67		−
68		−
69		−	// This next policy block is also pretty loose. It allows users who claim to
70		−	// be someone (via their cookie) to create, edit and comment on all pages,
71		−	// as well as upload files.
72		−	// They can also view the membership list of groups.
73		−
74		−	grant principal com.ecyrd.jspwiki.auth.authorize.Role "Asserted" {
75		−	// permission com.ecyrd.jspwiki.auth.permissions.PagePermission ":", "modify";
76		−	// permission com.ecyrd.jspwiki.auth.permissions.WikiPermission "*", "createPages";
77		−	permission com.ecyrd.jspwiki.auth.permissions.GroupPermission ":", "view";
78		−	};
79		−
80		−
81		−	// Authenticated users can do most things: view, create, edit and
82		−	// comment on all pages; upload files to existing ones; create and edit
83		−	// wiki groups; and rename existing pages. Authenticated users can also
84		−	// edit groups they are members of.
85		−
86		−	grant principal com.ecyrd.jspwiki.auth.authorize.Role "Authenticated" {
87		−	// permission com.ecyrd.jspwiki.auth.permissions.PagePermission ":", "modify,rename";
88		−	permission com.ecyrd.jspwiki.auth.permissions.GroupPermission ":", "view";
89		−	// permission com.ecyrd.jspwiki.auth.permissions.GroupPermission "*:<groupmember>", "edit";
90		−	// permission com.ecyrd.jspwiki.auth.permissions.WikiPermission "*", "createPages,createGroups";
91		−	};
92		−
93		−
94		−	// Administrators (principals or roles possessing AllPermission)
95		−	// are allowed to delete any page, and can edit, rename and delete
96		−	// groups. You should match the permission target (here, 'JSPWiki')
97		−	// with the value of the 'jspwiki.applicationName' property in
98		−	// jspwiki.properties. Two administative groups are set up below:
99		−	// the wiki group "Admin" (stored by default in wiki page GroupAdmin)
100		−	// and the container role "Admin" (managed by the web container).
101		−
102		−	grant principal com.ecyrd.jspwiki.auth.GroupPrincipal "Admin" {
103		−	permission com.ecyrd.jspwiki.auth.permissions.AllPermission "*";
104		−	};
105		−	grant principal com.ecyrd.jspwiki.auth.authorize.Role "Admin" {
106		−	permission com.ecyrd.jspwiki.auth.permissions.AllPermission "*";
107		−	};
108		−
109		−	grant principal com.ecyrd.jspwiki.auth.GroupPrincipal "myUserGroup" {
110		−	permission com.ecyrd.jspwiki.auth.permissions.PagePermission ":", "modify,rename";
111		−	permission com.ecyrd.jspwiki.auth.permissions.GroupPermission ":", "view";
112		−	permission com.ecyrd.jspwiki.auth.permissions.WikiPermission "*", "createPages";
113		−	};
114	20		}}}
	21	+	Restart the server after changing the policy. Details: [JSPWiki security documentation\|https://jspwiki-wiki.apache.org/Wiki.jsp?page=Wiki.Admin.Security].
115	22
116	23

Page revision history

Page References

Annotate

Version management