|
1 |
== Trac Permissions == |
|
2 |
[[TracGuideToc]] |
|
3 |
|
|
4 |
Trac uses a simple but flexible permission system to control what users can and can't access. |
|
5 |
|
|
6 |
Permission privilegies are managed using the [wiki:TracAdmin trac-admin] tool. |
|
7 |
|
|
8 |
Regular visitors, non-authenticated users, accessing the system are assigned the default |
|
9 |
role (''user'') named {{{anonymous}}}. |
|
10 |
Assign permissions to the {{{anonymous}}} user to set privilegies for non-authenticated/guest users. |
|
11 |
|
|
12 |
In addition to these privileges users can be granted additional individual |
|
13 |
rights in effect when authenticated and logged into the system. |
|
14 |
|
|
15 |
=== Available privileges === |
|
16 |
|
|
17 |
* {{{TRAC_ADMIN}}} |
|
18 |
* {{{LOG_VIEW}}} |
|
19 |
* {{{FILE_VIEW}}} |
|
20 |
* {{{CHANGESET_VIEW}}} |
|
21 |
* {{{BROWSER_VIEW}}} |
|
22 |
* {{{TICKET_VIEW, TICKET_CREATE, TICKET_MODIFY, TICKET_ADMIN}}} |
|
23 |
* {{{REPORT_VIEW, REPORT_CREATE, REPORT_MODIFY, REPORT_DELETE, REPORT_ADMIN, REPORT_SQL_VIEW}}} |
|
24 |
* {{{WIKI_VIEW, WIKI_CREATE, WIKI_MODIFY, WIKI_DELETE, WIKI_ADMIN}}} |
|
25 |
* {{{MILESTONE_VIEW, MILESTONE_CREATE, MILESTONE_MODIFY, MILESTONE_DELETE}}} |
|
26 |
* {{{ROADMAP_VIEW, ROADMAP_ADMIN}}} |
|
27 |
* {{{TIMELINE_VIEW}}} |
|
28 |
* {{{SEARCH_VIEW}}} |
|
29 |
* {{{CONFIG_VIEW}}} |
|
30 |
|
|
31 |
The {{{something_ADMIN}}} privileges are just shortcuts that can be used to grant a user all the ''something'' privileges in one go. Having {{{TRAC_ADMIN}}} |
|
32 |
is like being {{{root}}} on a *NIX system, it will let you do anything you want. |
|
33 |
|
|
34 |
=== Granting privileges === |
|
35 |
|
|
36 |
Currently the only way to grant privileges to users is by using the |
|
37 |
{{{trac-admin}}} script. The current set of privileges can be listed |
|
38 |
with the following command: |
|
39 |
|
|
40 |
{{{ |
|
41 |
$ trac-admin /path/to/projenv permission list |
|
42 |
}}} |
|
43 |
|
|
44 |
This command will let the user ''bob'' delete reports: |
|
45 |
|
|
46 |
{{{ |
|
47 |
$ trac-admin /path/to/projenv permission add bob REPORT_DELETE |
|
48 |
}}} |
|
49 |
|
|
50 |
=== Permission groups === |
|
51 |
|
|
52 |
Permissions can be grouped together to form roles such as |
|
53 |
''developer'', ''admin'', etc. |
|
54 |
|
|
55 |
{{{ |
|
56 |
$ trac-admin /path/to/projenv permission add developer WIKI_ADMIN |
|
57 |
$ trac-admin /path/to/projenv permission add developer REPORT_ADMIN |
|
58 |
$ trac-admin /path/to/projenv permission add developer TICKET_MODIFY |
|
59 |
$ trac-admin /path/to/projenv permission add bob developer |
|
60 |
$ trac-admin /path/to/projenv permission add john developer |
|
61 |
}}} |
|
62 |
|
|
63 |
=== Default permissions === |
|
64 |
|
|
65 |
Granting privileges to the special user ''anonymous'' can be used to control |
|
66 |
what an anonymous user can do before they have logged in. |
|
67 |
|
|
68 |
In the same way, privileges granted to the special user ''authenticated'' will apply to any authenticated (logged in) user. |
|
69 |
|
|
70 |
---- |
|
71 |
See also: TracAdmin, TracGuide |