D3web: D3web-KnowWE - change user rights for KnowWE

This page (revision-4) was last changed on 16-Oct-2026 11:10 by Albrecht Striffler

This page was created on 08-Nov-2013 11:23 by CarstenWasner

Only authorized users are allowed to rename pages.

Only authorized users are allowed to delete pages.

Page revision history

Version	Date Modified	Size	Author	Changes ...	Change note
4	16-Oct-2026 11:10	1 KB	Albrecht Striffler	to previous	Replace the com.ecyrd example (broken since JSPWiki 2.11) with the shipped policy variants
3	08-Nov-2013 11:23	5 KB	Albrecht Striffler	to previous \| to last
2	18-Dec-2012 14:49	5 KB	Jochen Reutelshöfer	to previous \| to last
1	08-Nov-2013 11:23	5 KB	CarstenWasner	to last

Page References

Incoming links	Outgoing links
D3web-KnowWE - change user rights for KnowWE CarstenWasner D3web-KnowWE - host multiple wikis Tutorial	D3web-KnowWE - change user rights for KnowWE

1	1		!!! d3web-KnowWE - change user rights for KnowWE.
2		−
3	2		When working in larger groups, it might be necessary to restrict user access to wikipages.
4		−	This can be done on eache wikipage individually, but yields problems like maintainance issues or excessive editing. \\
	3	+	This can be done on each wikipage individually, but yields problems like maintainance issues or excessive editing. \\
5	4		A better solution would be to create wiki specific user groups an define access rules.
6	5
7		−	In __${KnowWE-Home}\webapps\KnowWE\WEB-INF\jspwiki.properties activate__\\
8		−	__java.security.policy = $basedir\knowWeWiki.policy__
	6	+	The access rules are defined in the policy file {{webapps/KnowWE/WEB-INF/jspwiki.policy}}. Which file is used is set by {{jspwiki.policy.file}} in {{WEB-INF/classes/jspwiki-custom.properties}} (relative to the folder {{WEB-INF}} or absolute). The distribution ships these variants:
	7	+	* {{jspwiki.policy}} (default): everyone may view, edit, rename and delete pages. Only suitable for a local installation.
	8	+	* {{jspwiki-readonly.policy}}: everyone may read, logged-in users edit.
	9	+	* {{jspwiki-authonly.policy}}: only logged-in users read and edit.
	10	+	* {{jspwiki-authonly-roles.policy}}: logged-in users read, members of the wiki group ''Editor'' edit.
	11	+	In all of them, members of the wiki group ''Admin'' may do everything. Since everyone can register an account, also consider letting an admin approve new accounts: {{jspwiki.approver.workflow.createUserProfile = Admin}}.
9	12
10		−
11		−	In this policy-file define your specific rules:
	13	+	For own rules, grant permissions to a wiki group, e.g. a group ''myUserGroup'' created in the wiki ({{NewGroup.jsp}}):
12	14		{{{
13		−	EXAMPLE
14		−	// $Id: jspwiki.policy,v 1.23 2007-07-06 10:36:36 jalkanen Exp $
15		−	//
16		−	// This file contains the local security policy for JSPWiki.
17		−	// It provides the permissions rules for the JSPWiki
18		−	// environment, and should be suitable for most purposes.
19		−	// JSPWiki will load this policy when the wiki webapp starts.
20		−	//
21		−	// As noted, this is the 'local' policy for this instance of JSPWiki.
22		−	// You can also use the standard Java 2 security policy mechanisms
23		−	// to create a consolidated 'global policy' (JVM-wide) that will be checked first,
24		−	// before this local policy. This is ideal for situations in which you are
25		−	// running multiple instances of JSPWiki in your web container.
26		−	// To set a global security policy for all running instances of JSPWiki,
27		−	// you will need to specify the location of the global policy by setting the
28		−	// JVM system property 'java.security.policy' in the command line script
29		−	// you use to start your web container. See the documentation
30		−	// pages at http://doc.jspwiki.org/2.4/wiki/InstallingJSPWiki. If you
31		−	// don't know what this means, don't worry about it.
32		−	//
33		−	// Also, if you are running JSPWiki with a security policy, you will probably
34		−	// want to copy the contents of the file jspwiki-container.policy into your
35		−	// container's policy. See that file for more details.
36		−	//
37		−	// ------ EVERYTHING THAT FOLLOWS IS THE 'LOCAL' POLICY FOR YOUR WIKI ------
38		−
39		−	// The first policy block grants privileges that all users need, regardless of
40		−	// the roles or groups they belong to. Everyone can register with the wiki and
41		−	// log in. Everyone can edit their profile after they authenticate.
42		−	// Everyone can also view all wiki pages unless otherwise protected by an ACL.
43		−	// If that seems too loose for your needs, you can restrict page-viewing
44		−	// privileges by moving the PagePermission 'view' grant to one of the other blocks.
45		−
46		−	grant principal com.ecyrd.jspwiki.auth.authorize.Role "All" {
47		−	permission com.ecyrd.jspwiki.auth.permissions.PagePermission ":", "view";
48		−	permission com.ecyrd.jspwiki.auth.permissions.WikiPermission "*", "editPreferences";
49		−	permission com.ecyrd.jspwiki.auth.permissions.WikiPermission "*", "editProfile";
50		−	permission com.ecyrd.jspwiki.auth.permissions.WikiPermission "*", "login";
	15	+	grant principal org.apache.wiki.auth.GroupPrincipal "myUserGroup" {
	16	+	permission org.apache.wiki.auth.permissions.PagePermission ":", "modify,rename";
	17	+	permission org.apache.wiki.auth.permissions.GroupPermission ":", "view";
	18	+	permission org.apache.wiki.auth.permissions.WikiPermission "*", "createPages";
51	19		};
52		−
53		−
54		−	// The second policy block is extremely loose, and unsuited for public-facing wikis.
55		−	// Anonymous users are allowed to create, edit and comment on all pages.
56		−	//
57		−	// Note: For Internet-facing wikis, you are strongly advised to remove the
58		−	// lines containing the "modify" and "createPages" permissions; this will make
59		−	// the wiki read-only for anonymous users.
60		−
61		−	// Note that "modify" implies both "edit" and "upload", so if you wish to
62		−	// allow editing only, then replace "modify" with "edit".
63		−
64		−	grant principal com.ecyrd.jspwiki.auth.authorize.Role "Anonymous" {
65		−	// permission com.ecyrd.jspwiki.auth.permissions.PagePermission ":", "modify";
66		−	// permission com.ecyrd.jspwiki.auth.permissions.WikiPermission "*", "createPages";
67		−	};
68		−
69		−
70		−	// This next policy block is also pretty loose. It allows users who claim to
71		−	// be someone (via their cookie) to create, edit and comment on all pages,
72		−	// as well as upload files.
73		−	// They can also view the membership list of groups.
74		−
75		−	grant principal com.ecyrd.jspwiki.auth.authorize.Role "Asserted" {
76		−	// permission com.ecyrd.jspwiki.auth.permissions.PagePermission ":", "modify";
77		−	// permission com.ecyrd.jspwiki.auth.permissions.WikiPermission "*", "createPages";
78		−	permission com.ecyrd.jspwiki.auth.permissions.GroupPermission ":", "view";
79		−	};
80		−
81		−
82		−	// Authenticated users can do most things: view, create, edit and
83		−	// comment on all pages; upload files to existing ones; create and edit
84		−	// wiki groups; and rename existing pages. Authenticated users can also
85		−	// edit groups they are members of.
86		−
87		−	grant principal com.ecyrd.jspwiki.auth.authorize.Role "Authenticated" {
88		−	// permission com.ecyrd.jspwiki.auth.permissions.PagePermission ":", "modify,rename";
89		−	permission com.ecyrd.jspwiki.auth.permissions.GroupPermission ":", "view";
90		−	// permission com.ecyrd.jspwiki.auth.permissions.GroupPermission "*:<groupmember>", "edit";
91		−	// permission com.ecyrd.jspwiki.auth.permissions.WikiPermission "*", "createPages,createGroups";
92		−	};
93		−
94		−
95		−	// Administrators (principals or roles possessing AllPermission)
96		−	// are allowed to delete any page, and can edit, rename and delete
97		−	// groups. You should match the permission target (here, 'JSPWiki')
98		−	// with the value of the 'jspwiki.applicationName' property in
99		−	// jspwiki.properties. Two administative groups are set up below:
100		−	// the wiki group "Admin" (stored by default in wiki page GroupAdmin)
101		−	// and the container role "Admin" (managed by the web container).
102		−
103		−	grant principal com.ecyrd.jspwiki.auth.GroupPrincipal "Admin" {
104		−	permission com.ecyrd.jspwiki.auth.permissions.AllPermission "*";
105		−	};
106		−	grant principal com.ecyrd.jspwiki.auth.authorize.Role "Admin" {
107		−	permission com.ecyrd.jspwiki.auth.permissions.AllPermission "*";
108		−	};
109		−
110		−	grant principal com.ecyrd.jspwiki.auth.GroupPrincipal "myUserGroup" {
111		−	permission com.ecyrd.jspwiki.auth.permissions.PagePermission ":", "modify,rename";
112		−	permission com.ecyrd.jspwiki.auth.permissions.GroupPermission ":", "view";
113		−	permission com.ecyrd.jspwiki.auth.permissions.WikiPermission "*", "createPages";
114		−	};
115	20		}}}
	21	+	Restart the server after changing the policy. Details: [JSPWiki security documentation\|https://jspwiki-wiki.apache.org/Wiki.jsp?page=Wiki.Admin.Security].
116	22
	23	+

Page revision history

Page References

Annotate

Version management