Version 7 (modified by puffy, 9 years ago) (diff)


Role-Based Access Control for the Trac Wiki


WikiRBAC modifies the component to enforce Role-Based Access Control. Roles are configured as groups within the subversion authz file and ACLs are specified identically to subversion permissions, with the addition of 'c', 'd', and 'a' options, which control creation, deletion, and administration permissions respectively.

See also AuthzWebadminPlugin


As of [382], WikiRBAC can not increase a user's permissions. It can only limit them. That is, if user jru does not have WIKI_MODIFY permission, then telling WikiRBAC to let him modify some page or subwiki will not work. The user jru must have WIKI_MODIFY permission and WikiRBAC authorization in order to modify a page or subwiki.
WIKI_ADMIN permission overrides all WIKI_RBAC checks.

Bugs/Feature Requests

Existing bugs and feature requests for WikiRbacPatch are here.

If you have any issues, create a new ticket.


Download the zipped source from here.


You can check out WikiRbacPatch from here using Subversion, or browse the source with Trac.


Install the patch.
Add the following to trac.ini's [wiki] section:

authz_svn_module_name = tracwiki
authorization_mode = require_all
#authz_file = <path_to_some_authz_file> (optional)


The authz_svn_module directive specifies which subversion module to masquerade as. Recall that an authz section is of the form [ [module]:path ]. Leaving this empty is a bad idea.
The authorization_mode option tells the wiki authorization subsystem how to behave. Since the module exposes an extension point, plugins can be written to provide other authorization methods -- specifically, those that are not based around Subversion's Authz file. A setting of require_all means that every authorizer must successfully authorize an operation in order for that operation to be authorized. In contrast, require_one (to be renamed to require_any needs at least one authorizer to approve an operation in order that operation be authorized. Not including this directive, or setting it to any other string (such as none) will result in the RBAC system being deactivated.
The authz_file option specifies a path to a file in authz format. This is intended to allow the wiki component to get its authorization from a different file than Subversion's authz, or to provide an authz file when Subversion is not being used. Just as an example, one might add to the subversion authz file (or set the authz_file directive in the wiki section to something appropriate):

example = mrfoo,mrsbaz
losers = somedude

* = r #give everyone read access

@example = a #give admin permission to the example group.

@losers = rwc #give the losers group authorization to read, edit, and create wiki pages.

Recent Changes

[634] by puffy on 2006-04-09 21:08:54

Integrate heinlein@…'s modifications (see ticket #221) to get WikiRBAC to apply on > 0.9.2.

[388] by puffy on 2006-01-20 20:41:21

Fix the calling semantics on WikiAuthorizer so it takes a permission system rather than a request.

[382] by puffy on 2006-01-20 14:46:32

Initial import of the WikiRBAC patch.


Author: puffy