A strategy may be to grant only view rights to the XWikiAllUsers group and to grant edit right to a new Editors group. Then you have to add the regular users to this new group. Another way is to delete your specific user from the XWikiAllUsers group but I'm not sure that it's really safe. Hope this help. Maxime 2013/1/11 Hamster <[email protected]>

Hi all,

We are using LDAP and I want to grant a specific user ONLY view-rights (on the entire wiki)

As far as I can see, I can't just grant him "view-only" rights to the wiki, because the space-rights will grant the user edit rights (the user is also in the XWikiAllUsers group).

Do I need to apply "view-only" rights for that specific user on every space in the wiki?

If that's the case, how do I handle the fact when an "admin"-user creates a new space? (where the specific user should have "view-only" rights by default?) That's kind of dangerous, don't you think?

Or am I missing something?

-- View this message in context: http://xwiki.475771.n2.nabble.com/Grant-only-View-Rights-to-a-specific-user-... Sent from the XWiki- Users mailing list archive at Nabble.com. _______________________________________________ users mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/users

Any suggestions from the developers of XWiki? -- View this message in context: http://xwiki.475771.n2.nabble.com/Grant-only-View-Rights-to-a-specific-user-... Sent from the XWiki- Users mailing list archive at Nabble.com.

Hi, As far as I can see it, Maxime's suggestion is a legitimate one. The most specific right (space) wins over a more general one (wiki). So if you only have 1 group (XWikiAllGroup) where at wiki level everyone has view and in various spaces the same group gets edit rights, then all its members will have edit rights for that space, including your specific user (which is a member of XWikiAllGroup). Since your users come from LDAP, you should be able to specify group membership from LDAP. Then, when you create a space and explicitly assign edit rights to XWikiAllGroup, do it for Editors instead. This way not *every* user will get edit rights, just the ones that need to (specified from LDAP by being members of the Editors group). You can not have a zero-maintenance setup with just a single group. Thanks, Eduard On Tue, Jan 29, 2013 at 8:44 AM, Hamster <[email protected]> wrote:

I am still struggling with this issue...who can help?

-- View this message in context: http://xwiki.475771.n2.nabble.com/Grant-only-View-Rights-to-a-specific-user-... Sent from the XWiki- Users mailing list archive at Nabble.com. _______________________________________________ users mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/users