Документ взят из кэша поисковой машины. Адрес
оригинального документа
: http://www.atnf.csiro.au/research/pulsar/tempo2/index.php?n=PmWiki.AuthUser
Дата изменения: Unknown Дата индексирования: Tue Jun 29 11:14:58 2010 Кодировка: Поисковые слова: interstellar medium |
PmWiki /
AuthUseradministrators (intermediate) AuthUser is PmWiki's identity-based authorization system that allows access to pages to be controlled through the use of usernames and passwords. AuthUser can be used in addition to the password-based scheme that is PmWiki's default configuration. AuthUser is a very flexible system for managing access control on pages, but flexibility can also bring complexity and increased maintenance overhead to the wiki administrator. This is why PmWiki defaults to the simpler password-based system. For some thoughts about the relative merits of the two approaches, see PmWiki:ThoughtsOnAccessControl. Activating AuthUserTo activate PmWiki's identity-based system, add the following line to local/config.php: include_once(" Creating user accountsMost of AuthUser's configuration is performed via the Site.AuthUser page. To change the AuthUser configuration, simply edit this page like any other wiki page (you'll typically need to use the site's admin password for this). To create a login account, simply add lines to Site.AuthUser that look like: username: (:encrypt password:) For example, to create a login account for "alice" with a password of "wonderland", enter: alice: (:encrypt wonderland:) When the page is saved, the " For greater security, place a read password on the Site.AuthUser page.
To change or reset an account's password, simply replace the encrypted string with another Controlling access to pages by loginPages and groups can be protected based on login account by using "passwords" of the form It's possible to use multiple "id:" declarations and passwords in the quick id:alice,carol To allow access to anyone that has successfully logged in, use " One can also perform site-wide restrictions based on identity in the # require valid login before viewing pages You can change the
Organizing accounts into groupsAuthUser also makes it possible to group login accounts together into authorization groups, indicated by a leading "@" sign. As with login accounts, group memberships are maintained by editing the Site.AuthUser page. Group memberships can be specified by either listing the groups for a login account (person belongs to groups) or the login accounts for a group (group includes people). You can repeat or mix-and-match the two kinds as desired: @writers: alice, bob carol: @writers, @editors @admins: alice, dave Then, to restrict page access to a particular group, simply use " Excluding individuals from password groupsGroup password memberships are maintained by editing the Site.AuthUser page. To specify a password group that allows access to anyone who is authenticated, you can specify: @wholeoffice: * If you need to keep "Fred" out of this password group, you might try: @wholeoffice: *, -Fred ... but this does not work. You can, however, get the desired result by using the first setting (@wholeoffice: *) on the Site.AuthUser page and then setting the password for the page or group you wish to protect in Getting account names and passwords from external sourcesThe AuthUser script has the capability of obtaining username/password pairs from places other than the Site.AuthUser page, such as passwd-formatted files (usually called '.htpasswd' on Apache servers), LDAP servers, or even the local/config.php file. Passwd-formatted files (.htpasswd/.htgroup)Passwd-formatted files, commonly called .htpasswd files in Apache, are text files where each line contains a username and an encrypted password separated by a colon. A typical .htpasswd file might look like: alice:vK99sgDV1an6I
carol:Q1kSeNcTfwqjs
To get AuthUser to obtain usernames and passwords from a .htaccess file, add the following line to Site.AuthUser, replacing "/path/to/.htpasswd" with the filesystem path of the .htpasswd file: htpasswd: /path/to/.htpasswd Creation and maintenance of the .htpasswd file can be performed using a text editor, or any number of other third-party tools available for maintaining .htpasswd files. The Apache web server typically includes an htpasswd command for creating accounts in .htpasswd: $ htpasswd /path/to/.htpasswd alice New password: Re-type new password: Adding password for user alice $ Similarly, one can use .htgroup formatted files to specify group memberships. Each line has the name of a group (without the "@"), followed by a colon, followed by a space separated list of usernames in the group. writers: carol editors: alice carol bob admins: alice dave Note that the groups are still "@writers", "@editors", and "@admins" in PmWiki even though the file doesn't specify the @ signs. To get AuthUser to load these groups, use a line in Site.AuthUser like: htgroup: /path/to/.htgroup Configuration via local/config.phpAuthUser configuration settings can also be made from the local/config.php file in addition to the Site.AuthUser page. Such settings are placed in the $AuthUser array, and must be set prior to including the authuser.php script. Some examples: # set a password for alice $AuthUser['alice'] = crypt('wonderland'); # set a password for carol $AuthUser['carol'] = '$1$CknC8zAs$dC8z2vu3UvnIXMfOcGDON0'; # define the @editors group $AuthUser['@editors'] = array('alice', 'carol', 'bob'); # Use local/.htpasswd for usernames/passwords $AuthUser['htpasswd'] = 'local/.htpasswd'; # Use local/.htgroup for group memberships $AuthUser['htgroup'] = 'local/.htgroup'; Configuration via LDAPAuthentication can be performed via an external LDAP server -- simply set an entry for "ldap" in either Site.AuthUser or the local/config.php file. # use ldap.airius.com for authentication $AuthUser['ldap'] = 'ldap://ldap.airius.com/ou=People,o=Airius?cn?sub'; LDAP authentication in AuthUser closely follows the model used by Apache 2.0's mod_auth_ldap module; see especially the documentation for AuthLDAPUrl for a description of the url format. For servers that don't allow anonymous binds, AuthUser provides Setting the Author NameBy default, PmWiki will use a login name in the Author field of the edit form, but allows the author to change this value prior to saving. To force the login name to always be used as the author name, use the following sequence to activate AuthUser: include_once(" See Also
<< Passwords administration | Documentation Index | Uploads administration >> |