Changes between Version 1 and Version 2 of TracFineGrainedPermissions

Timestamp:

Oct 10, 2014 10:47:28 AM (10 years ago)

Author:

trac

Comment:

--

TracFineGrainedPermissions

@@ +1 @@
+[[PageOutline(2-5, Contents, floated)]]
 = Fine grained permissions =
 
@@ -31 +32 @@
 ==== Configuration ====
 * Install [http://www.voidspace.org.uk/python/configobj.html ConfigObj] (still needed for 0.12).
-* Copy authz_policy.py into your plugins directory.
+* Copy authz_policy.py into your plugins directory (only for Trac 0.11).
 * Put a [http://swapoff.org/files/authzpolicy.conf authzpolicy.conf] file somewhere, preferably on a secured location on the server, not readable for others than the webuser. If the  file contains non-ASCII characters, the UTF-8 encoding should be used.
 * Update your `trac.ini`:
@@ -40 +41 @@
 permission_policies = AuthzPolicy, DefaultPermissionPolicy, LegacyAttachmentPolicy
 }}}
-  2. add a new `[authz_policy]` section
+  1. add a new `[authz_policy]` section
 {{{
 [authz_policy]
 authz_file = /some/trac/env/conf/authzpolicy.conf
 }}}
-  3. enable the single file plugin
+  1. enable the plugin through [/admin/general/plugin WebAdmin] or by editing the `[components]` section
 {{{
 [components]
@@ -54 +55 @@
 #authz_policy.* = enabled 
 }}}
+
+
 ==== Usage Notes ====
 Note that the order in which permission policies are specified is quite critical, 
@@ -107 +110 @@
     denied rather than granted.
 
-  The username will match any of 'anonymous',
-  'authenticated', <username> or '*', using normal Trac permission rules.
+  The username will match any of 'anonymous', 'authenticated', <username> or '*', using normal Trac permission rules. || '''Note:''' Other groups which are created by user (e.g. by 'adding subjects to groups' on web interface page //Admin / Permissions//) cannot be used. See [trac:ticket:5648 #5648] for details about this missing feature ||
 
 For example, if the `authz_file` contains:
@@ -190 +192 @@
 
 
+==== Missing Features ====
+Although possible with the !DefaultPermissionPolicy handling (see Admin panel), fine-grained permissions still miss those grouping features (see [trac:ticket:9573 #9573], [trac:ticket:5648 #5648]). Patches are partially available, see forgotten authz_policy.2.patch  part of [trac:ticket:6680 #6680]).
+
+You cannot do the following:
+{{{
+[groups]
+team1 = a, b, c
+team2 = d, e, f
+team3 = g, h, i
+departmentA = team1, team2
+}}}
+
+Permission groups are not supported either. You cannot do the following:
+{{{
+[groups]
+permission_level_1 = WIKI_VIEW, TICKET_VIEW
+permission_level_2  = permission_level_1, WIKI_MODIFY, TICKET_MODIFY
+[*]
+@team1 = permission_level_1
+@team2 = permission_level_2
+@team3 = permission_level_2, TICKET_CREATE
+}}}
+
 === !AuthzSourcePolicy  (mod_authz_svn-like permission policy) === #AuthzSourcePolicy