[xwiki-users] User Permissions Issue
Hi I’m experiencing an “odd” behaviour with certain permissions that are applied to spaces and I’m not sure if I’m just doing it wrong, it’s a bug or a limitation of the design. Basically we have a space for each department (e.g. Sales, Accounts, HR etc.). I have then created 3 groups for each department examples as below: - Sales-Admin – Full permissions including admin - Sales-Write – All permissions except Admin rights - Sales-Read – View and Comment rights only What I’ve had is if a user is in Sales-Admin group, then they cannot see any of the documents unless they are also a member of the Sales-Write group. This seems strange to me. Basically we have Sales-Admin contains: UserA UserB Sales-Write contains: UserC UserD Sales-Read contains: No users in this group The permissions are set as follows in the order it appears: Sales Admin – View=Ticked, Comment=Ticked, Edit=Ticked, Delete=Ticked, Admin=Ticked Sales-Read – View=Ticked, Comment=Ticked, Edit=Deny, Delete=Deny, Admin=Deny Sales-Write = View=Ticked, , Comment=Ticked, Edit=Ticked, Delete=Deny, Admin=Deny In some cases instead of specific deny, we just don’t tick that specific permission and still have issues with users not being able to see things unless they are made a member of another group. Hopefully someone can help implement the permissions correctly with granular control. Thanks in advance for your time. Kind regards, Mahomed Hussein Senior NOC Engineer P.S. We are finalists for Data Centre Colocation Supplier of the year, please help us to win and VOTE<http://www.dcsawards.com/voting.php> for us here<http://www.dcsawards.com/voting.php> Tel: +44 (0)1622 230382 | Email: [email protected] | Web: www.CustodianDC.com<http://www.CustodianDC.com> | Info: info.CustodianDC.com<http://info.CustodianDC.com> [Custodian Data Centres]<http://www.CustodianDC.com> [ISO 27001 IS:567248] Click to VOTE<http://www.dcsawards.com/voting.php> for Custodian! [DCS Awards Finalist] [Like us on Facebook!][Follow us on Twitter][See us on YouTube!] [Link to us!][Google Plus!] Click here to view our email disclaimer<http://www.custodiandc.com/disclaimer.txt> Registered Office: Maidstone TV Studios, Vinters Park, Maidstone, Kent ME14 5NZ. Company Number: 07878023
Hi I've tried reading through the security and rights articles but I'm afraid it hasn't really helped make things any clearer for me. At the moment I have this very strange scenario where adding/removing users to a group doesn't immediately (or at all) apply the permission unless I add and remove XWikiAllGroup to the group and then remove it. <http://xwiki.475771.n2.nabble.com/file/n7594521/sales_rights.png> Above is how the permissions are applied to the Sales space. I then add my "MH Test" user to one group (e.g. sales_write) and then try and refresh in Firefox (Using private mode and clearing the local cache. Using refresh=1 doesn't help either). Only once did I manage to make the user able to see the space. But, if I add the test user to the group and then add XWikiAllGroup and refresh then I can see the space. If I then remove XWikiAllGroup from the group, I can STILL see the space and make changes etc. I have allowed XWikiAllGroup View Permission in a different group called "General-Read" which I created in order to allow read-access to the General space. It appears to me that XWiki is seeing the user as part of XWikiAllGroup in General-Read and see that General-Read doesn't have explicit allow or deny and then ties with the permission of "allow" in Sales_Read and apparently Deny wins? Below are screenshots of how the General-* has its permissions applied in the Sales space. <http://xwiki.475771.n2.nabble.com/file/n7594521/general_permissions_in_sales.png> I have gone further and removed XWikiAllGroup from General-Read and I can then immediately see the permissions in the Sales-* groups being applied. If I then add the Sales-* groups as sub-groups of General-Read, then I get the same behaviour, i.e. user of Sales* gets denied permission. As I write this, I'm starting to think/understand that this is the designed behaviour and my only solution will be to use Sub-Wikis instead of spaces. So for example Sales sub-wiki and General sub-wiki. Users would be members/registered to the main wiki, but I could then create groups in the sub-wiki for Read, Read/Write, Admin and it wouldn't get over-ridden/collide with permissions/user in other groups. Can anyone tell me if I'm on the right track or point me at some documentation or provide some tips please? Thanks in advance for your time and help. -- View this message in context: http://xwiki.475771.n2.nabble.com/User-Permissions-Issue-tp7594486p7594521.h... Sent from the XWiki- Users mailing list archive at Nabble.com.
Hi As anyone else got any tips/suggestions/advice/links on a better way of restricting access to document and even spaces? The sub-wiki idea may work, but it's a LOT of work (even though we just started using the Wiki, people have fallen in love with XWiki and we now have quite an amount data in the system). Am I correct that in order to get "proper" use out of the permissions system, users can only be members of one group (possibly excluding the XWikiAllGroup)? -- View this message in context: http://xwiki.475771.n2.nabble.com/User-Permissions-Issue-tp7594486p7594579.h... Sent from the XWiki- Users mailing list archive at Nabble.com.
Here's how I have created the permissions of our spaces: SpaceAdmin - Thicked all SpaceEditor - Thicked "View", "Comment" and "Edit" SpaceViewer - Thicked "View" and "Comment" So basicly your first screenshot. There's no need apply any "Deny" rights. The thicks of the SpaceAdmin will deny those rights for anyone NOT in the SpaceAdmin group. Thus you need to apply the thicks on View, Comment and Edit in the other groups. In order to see these right changes, I always close my browser (IE11) and open XWiki again. HTH! -- View this message in context: http://xwiki.475771.n2.nabble.com/User-Permissions-Issue-tp7594486p7594587.h... Sent from the XWiki- Users mailing list archive at Nabble.com.
Hi Thanks for the response. What you have shown seems to work partially for us. The issue happens if the user is a member of a group for a different space. So taking your example a bit further: Space1Admin - ticked all Space1Editor - ticked "View", "Comment" and "Edit" Space1Viewer - ticked "View" and "Comment" Space2Admin - ticked all Space2Editor - ticked "View", "Comment" and "Edit" Space2Viewer - ticked "View" and "Comment" If user is member of Space1Viewer and Space2Admin then the user usually ends up with no access to Space2. This is where our problem comes up because we need some users to be members of multiple spaces. No help from Devs please? -- View this message in context: http://xwiki.475771.n2.nabble.com/User-Permissions-Issue-tp7594486p7594593.h... Sent from the XWiki- Users mailing list archive at Nabble.com.
Just a few questions: Are you using a "single WIKI"? Are you applying the rights at the "Space Level"? -- View this message in context: http://xwiki.475771.n2.nabble.com/User-Permissions-Issue-tp7594486p7594616.h... Sent from the XWiki- Users mailing list archive at Nabble.com.
Hi Yes, at the moment we only have one main wiki (no sub-wikis). I have created the groups at the main level and added the members there. I then go into the space (e.g. Sales) then I go to Administer Space > Click "Rights" under "Users and Groups" > Tick the relevant access for the specific group (e.g. SalesAdmin, SalesRead, SalesWrite). I repeat these steps in every space (such as Accounts, HR etc.) But sometimes we may have someone who can be admin in the Accounts Space, but read-only in the Sales space. In such a case, the user then loses access to the Sales space. -- View this message in context: http://xwiki.475771.n2.nabble.com/User-Permissions-Issue-tp7594486p7594617.h... Sent from the XWiki- Users mailing list archive at Nabble.com.
Hmmm...that sounds exactly how we have managed the rights (XWiki 5.4.3) Maybe a dev could help??? -shout- -- View this message in context: http://xwiki.475771.n2.nabble.com/User-Permissions-Issue-tp7594486p7594619.h... Sent from the XWiki- Users mailing list archive at Nabble.com.
Do you have users who are members of groups for different spaces? Or do you only have users who can only access one space? I'm also hoping a dev can answer. If not, I guess the next stage will be to log a bug on Jira. -- View this message in context: http://xwiki.475771.n2.nabble.com/User-Permissions-Issue-tp7594486p7594620.h... Sent from the XWiki- Users mailing list archive at Nabble.com.
Yes, we also have users which are in multiple groups. No problems here... -- View this message in context: http://xwiki.475771.n2.nabble.com/User-Permissions-Issue-tp7594486p7594639.h... Sent from the XWiki- Users mailing list archive at Nabble.com.
Thanks for still responding Hamster. Am I correct that you are using version 5.4.3 and not version 7? I think it got changed/broken in v6 -- View this message in context: http://xwiki.475771.n2.nabble.com/User-Permissions-Issue-tp7594486p7594646.h... Sent from the XWiki- Users mailing list archive at Nabble.com.
We just added a note to the 6.4.3 RN http://www.xwiki.org/xwiki/bin/view/ReleaseNotes/ReleaseNotesXWiki643 . Check the text in red. Maybe you are facing the same issue. On Tue, Apr 14, 2015 at 7:22 PM, mahomed <[email protected]> wrote:
Thanks for still responding Hamster. Am I correct that you are using version 5.4.3 and not version 7? I think it got changed/broken in v6
-- View this message in context: http://xwiki.475771.n2.nabble.com/User-Permissions-Issue-tp7594486p7594646.h... Sent from the XWiki- Users mailing list archive at Nabble.com. _______________________________________________ users mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/users
And 6.4.4 has now been released with a fix! :) Thanks -Vincent On 16 Apr 2015 at 11:00:02, Marius Dumitru Florea ([email protected](mailto:[email protected])) wrote:
We just added a note to the 6.4.3 RN http://www.xwiki.org/xwiki/bin/view/ReleaseNotes/ReleaseNotesXWiki643 . Check the text in red. Maybe you are facing the same issue.
On Tue, Apr 14, 2015 at 7:22 PM, mahomed wrote:
Thanks for still responding Hamster. Am I correct that you are using version 5.4.3 and not version 7? I think it got changed/broken in v6
participants (5)
-
Hamster -
mahomed -
Mahomed Hussein
-
Marius Dumitru Florea -
vincent＠massol.net