===== ACL Administration =====

Make sure that you understood the concept of [[wiki:namespaces]] first. Namespaces are a bit like directories.

==== Users, Groups and Permissions ====

There are 2 special groups:

  * admin  (has full wiki access regardless of the permissions)
  * ALL    (represents any user, logged in, or without login, like someone visiting the page from outside)

There are 5 different rights that can be given to users or groups:

  * Read   (can view the page)
  * Edit   (can edit the page, can potentially remove all content, but old versions are kept in history)
  * Create (can create new pages in the namespace)
  * Upload (can upload documents, pdfs, images, etc)
  * Delete (can completely remove the page and history)

It is possible to assign the above rights to users or groups. If you want to create a new group, simply specify that you are setting group permission in the "//Add new Entry//" section, and type the new group name.

Make sure that you will add some users to this group in the user management panel later on :-)

==== Example of ACL administration ====
Let's see how it looks like with an example. To edit ACL permissions, go the page or namespace you want to change rights for, then click the "Admin" button.

{{wiki:acl_example.png}}


  * In this example, the group "//users//" has read and edit access everywhere (namespace *), while "//ALL//", can only read pages.

  * People from the group "//level1//", also have read and edit access, but only to the page "start/level1". They have additional rights, create and upload, to pages that belong to the namspace "start/level1/*" and beyond.

  * Also, the group "//level1_friends//" has read and edit access to every page in the "start/level1/*" namespace, including the "start/level1" page itself.

  * Note that it is possible to specify individual users instead of group names. It is also possible that namespaces beyond this one have restrictions. For example the group "//level1//" could be denied the right to read, edit, create, and upload in the namespace "start/level1/restricted_page"