Mailing-List: contact jspwiki-user-help@incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: jspwiki-user@incubator.apache.org
Received-SPF: pass (athena.apache.org: domain of andrew.r.jaquith@gmail.com
 designates 209.85.220.212 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:in-reply-to:references:date:message-id:subject:from:to
         :content-type:content-transfer-encoding;
        b=bx1pAhn0Qt7niAcO4/9wL5dmiEluzVmvB3ehBH7omSoWx+zPbqpuQMtT0IikfkOzGU
         EQASLKmCPJ9m9Wqmksa+RAohr24M1ODun7Kn11tdQH68bJbjhAAWA6uQnSldaXjNk0Fv
         +pEyDVacXEHO0Hroa0yqBGNPqg7Yl0bUyTRlM=
MIME-Version: 1.0
In-Reply-To: <CBEF73E5-BE81-4A63-9AB9-C9E70B143713@goodinassociates.com>
References: <CBEF73E5-BE81-4A63-9AB9-C9E70B143713@goodinassociates.com>
Date: Fri, 26 Mar 2010 12:59:03 -0400
Message-ID: <b90102161003260959g3c7091c9mc066e8c397cf80a0@mail.gmail.com>
Subject: Re: Of Permissions and ACLs
From: Andrew Jaquith <andrew.r.jaquith@gmail.com>
To: jspwiki-user@incubator.apache.org
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Peter, your understanding is correct. To accomplish what you want,
you'd need to edit the ACLs of the protected pages to include the
Editors. Or, as you pointed out, you can give the Editors the
AllPermission.

You can see why it is this way, right? Otherwise, ACLs would
essentially be meaningless because you could override any ACL by
modifying the base policy. But let me think about this a bit more.
Perhaps there is something we can do in the 3.1 timeframe.

Andrew

On Fri, Mar 26, 2010 at 12:19 PM, Peter Schart
<pete@goodinassociates.com> wrote:
> I'll try to keep this as brief as possible as I'm fairly sure it has a si=
mple answer. Here's the situation:
>
> I've got a wiki that has some fairly strict permissions:
> 1. Nothing is viewable unless asserted or authenticated.
> 2. Nothing is editable unless user is a member of group "Editors".
> 3. Non-editors belong to 1 of 3 groups (call them A, B, and C)
> 4. Some pages are viewable by all 3 groups; others are only viewable to 1=
 of the 3 groups (via ACLs, e.g.: [{ALLOW view A}].
>
> What I'd like to do (and what I think is impossible) is to allow members =
of the "Editors" group to be able to view/edit anything (regardless of what=
ever ACL a page might have) but not have AllPermissions (i.e.: they shouldn=
't be able to approve new users, delete pages, etc...).
>
> In my .policy, the Editors group has modify and rename for PagePermission=
s but I still get the "You're not allowed to do that" message when trying t=
o view any page with an "ALLOW view [A|B|C]" ACL.
>
> I *think* that the only way to override page ACLs is to give the group Al=
lPermission in the .policy. =C2=A0Is this correct? If so, is there anyway t=
o achieve the "Editors can edit anything but aren't admins" goal other than=
 adding "Editors" to every view ACL?
>
> Thanks for your help.