Extension:Group Based Access Control

From MediaWiki.org

Manual on MediaWiki Extensions
List of MediaWiki Extensions

Group Based AccessControl Release status: unknown
Implementation	User rights, Tag
Description	Extension to restrict access to specific pages based on groups.
Author(s)	Martin Gondermann
Last Version	0.8 (http://blog.pagansoft.de)
MediaWiki	1.11.0 and higher
License	No license specified
Download	here

[edit] Features

• easy to setup
• no patches, real extension
• as many groups as you want
• access is controlled for viewing and editing the pages (also if you access it manually per action=edit in the URL)
• only sysops can view and edit the special "Usergroup:.." pages
• All users in the sysop-Group (the one from mediaWiki) can see and edit the protected pages, so if you made a mistake, you can always correct it, even if the page is protected
• access can be granted to multiple groups
• read only access is also possible
• You can alternatively use the internal groups from your wiki for access control

[edit] Caveats

• Requires that you disable caching, otherwise the restrictions aren't consistently enforced
• Users can still use search feature to find unauthorized pages and see excerpts in the search results

Please read about security issues with authorization extensions

[edit] Documentation

[edit] Installation

• Step 1:
  • add the following lines to the bottom of your LocalSettings.php:

require_once("extensions/accesscontrolSettings.php");
include("extensions/accesscontrol.php");

• Step 2:
  • check (and maybe edit) the settings in accesscontrolSettings.php:

$wgAccessControlDisableMessages = false; // if false, show a Line on Top of each secured Page, which says, which Groups are allowed to see this page.
$wgAccessControlGroupPrefix = "Usergroup"; // The Prefix for the Usergroup-Pages
$wgAccessControlNoAccessPage = $wgScriptPath . "/index.php/No_Access"; // To this Page will these users redirected who are not allowed to see the page.
$wgWikiVersion = 1.6; // Set this to 1.7, if you use mediaWiki 1.7 or greater, this is for compatibility reasons
$wgUseMediaWikiGroups = false; // use the groups from MediaWiki instead of own Usergroup pages
$wgAdminCanReadAll = true; // sysop users can read all restricted pages
$wgGroupLineText = "This page is only accessible for group %s !!!"; // The text for the showing on the restricted pages, for one group
$wgGroupsLineText = "This page is only accessible for group %s !!!"; // The text for the showing on the restricted pages, for more than one group
$wgAccesscontrolDebug = false;	// Debug log on
$wgAccesscontrolDebugFile = "/var/www/wiki/config/debug.txt"; // Path to the debug log

• Step 3:
  • Create a Wiki-Page with the Name Usergroup:Groupname and add the Users in the Group in a Bulletlist
  • Example: You want the Group "IT-Department" with the Users "John Doe" and "Jane Doe" in it:
    • Create the Wiki-Article: "Usergroup:IT-Department" and put the following in its text:

*John Doe
*Jane Doe

There is a second possibility for using groups. You can set the variable $wgUseMediaWikiGroups to true and use the internal groups from MediaWiki. Then you can use the special page "Special:Userrights" for Useradministration and you don't have to create the Usergroup pages.

• Step 4:
  • Create a No-Access Page with the Name No_Access and Write some Text in it (i.e. "Access to this page is denied for you!")
  • If you want to protect the page, so the users of a group can read but not edit, you have to append "(ro)" to the group name.
  • Example:

    <accesscontrol>Administrators,,IT-Department(ro),,Sales(ro)</accesscontrol>
    

    In this example all users from the groups "Administrators", "IT-Department" and "Sales" can read the page but only the users from "Administrators" can edit it.
  • Attention for the german users: if you set $wgUseMediaWikiGroups to true then you have to use the english names for the groups i.E., instead of writing

    <accesscontrol>Bürokraten</accesscontrol>
    

    you have to write

    <accesscontrol>bureaucrats</accesscontrol>
    

[edit] Usage

That's it for the installation. To restrict access on a page-by-page basis to specific usergroups, just include the names of the allowed usergroups within a tag (separated by double commas) in the body of that page. Thus, if you wanted to restrict access to the people with usergroups "Administrators", "IT-Department" and "Sales", you would use the following syntax:

<accesscontrol>Administrators,,IT-Department,,Sales</accesscontrol>

[edit] Naming

This extension is referenced by three different names:

• AccessControl Extension (is the official name)

[edit] Example

See an example of this add-on in action at: Cubic Path Wiki run by the author of the AIM extension)

[edit] Tips

Version 0.7 of the extension does not work with MediaWiki 1.9

It works with mediawiki 1.9.3 (that's my solution for working, not more..) [1]

Important Info:

<accesscontrol>Administrators,,IT-Department,,Sales,,</accesscontrol>

Use for the last group also a ",," at the end (see above)

(With only one group it work without the ",," at the end)

[edit] See also

• Extension:BizzWiki
• Extension:AccessControl