Managing permissions
-
- Last edited 4 years ago by P technik
-
-
- This page is a draft but has an approved version
Contents
Access to the permission manager
To manage permissions, the extension BlueSpicePermissionManager provides the administrator interface. It is located under Global actions > Management > Permisison manager. This links to the page Special:PermissionManager:
Role-based permissions
In BlueSpice version 3.0 roles were introduced as a way to manage wiki rights, . The main intention of using roles is to simplify rights management.
Roles represent a collection of individual permissions that are necessary to perform certain function on the wiki. For example, for a user who is supposed to only read the wiki, many permissions in addition to the "read" permission are needed: the ability to change their own settings, to search the wiki, to view page ratings, and so on.
All permissions that make up a logical group are encapsulated in a role, in this example the role "reader". If wiki admins want to grant read-only rights to a user group, they only need to assign that group the "reader" role, instead of assigning many individual rights.
By assigning roles to a group, all users belonging to that group will receive the rights contained in these roles. Roles are not assigned directly to users, but to groups instead. Users are then assigned to one or more groups.
Default roles
By default, BlueSpicePermissionManager includes a number of pre-defined roles that serve most user needs on the wiki. The individual permissions contained in a role can be seen by clicking the info icon in front of the role name. It opens a dialog with a permissions list for the role:
- bot - typically assigned only to the bot group
- admin - all available rights. It should be assigned only to wiki-admin groups
- maintenanceadmin - very similar to the admin role, used for user groups that are responsible for maintaining wiki integrity
- author - all permissions necessary for creating content on the wiki
- editor - create content, edit and delete content, create reviews
- reviewer - all reviewing actions
- accountmanager - user account management rights
- structuremanager - move (rename) pages, create and delete namespaces
- reader - basic read-only access
- accountselfcreate - this role must be assinged to the "*" groups to allow users to self-create user accounts
- commenter - cannot create and edit content, can only comment on existing content
The roles matrix
The permission manager consists of the group tree (1) and the role matrix (2):
The group tree (on the left) shows all existing groups:
- Group "*": all non-logged-in (anonymous) users
- Group "user": all logged-in users, the default group for all users
- Subgroups of group "user": all groups that are defined on the wiki, eiter by default, by MediaWiki, or custom groups created by the wiki admins. System groups, created by MediaWiki, can be hidden by unchecking the "Show system groups" checkbox above the tree.
The columns in the role matrix are:
- Role information (info icon): Clicking the icon shows all the permissions in a role. This list is exportable.
- Role name
- Wiki: Assignment of a role to the entire wiki. By assigning the role in this column, a user group gets permissions in this role on the wiki (all namespaces).
- Individual namespaces: The following columns list every (applicable) namespace on the wiki.
- Roles can be assigned to individual namespaces. For example, the group user can get the editor role only in the namespace Public. Users in this group cannot edit content in any other . By granting a role to a particular group in a particular namespace, means that all other groups will lose permissions from this role, eg. granting role "reader" in namespace "Private" to group "sysop" means that all users in any other groups won't be able to read pages in "Private" namespace, even if they have "reader" role granted on the wiki level ("Wiki" column).
- The same role can be granted to multiple groups for the same namespace.
- Additional namespaces can be added in the matrix by clicking on the arrow in table header, then "Columns". Then the namespaces can be selected.
Role inheritance
By default, all roles granted to the (*) group will be granted to the user group, and all roles granted to the user group are granted to its subgroups. If a group inherits the role from an upper-level group field, this is indicated in the role matrix with a green background, but the checkbox is empty.
Technical info
Logging
Every change to the roles is logged in the MediaWiki log book, found under Special:Log under Permission Manager log type.
These logs are availble only to wiki administrators (users in groups with the role admin).
Backups
All changes to the role matrix are backed up. By default, the last 5 backups are kept. This limit can be changed in BlueSpiceConfigManager, under configs for the extension BlueSpicePermissionManager.
- Backup limit: Sets the number of backups for the permissions manager. Each time the page Special:PermissionManager is saved, a backup is created. If the backup limit is set to 5, the last five versions of the permissions configuration are saved as backups.