TracPermissions
Trac uses a simple, case sensitive, permission system to control what users can and can't access.
Permission privileges are managed using the [TracAdmin] tool or (new in version 0.11) the General / Permissions panel in the Admin tab of the web interface.
In addition to the default permission policy described in this page, it is possible to activate additional permission policies by enabling plugins and listing them in the `[trac] permission_policies` configuration entry in the TracIni. See TracFineGrainedPermissions for more details.
Non-authenticated users accessing the system are assigned the name "anonymous". Assign permissions to the "anonymous" user to set privileges for anonymous/guest users. The parts of Trac that a user does not have the privileges for will not be displayed in the navigation. In addition to these privileges, users can be granted additional individual rights in effect when authenticated and logged into the system. All logged in users belong to the virtual group "authenticated", which inherits permissions from "anonymous".
This feature is new in version 0.11.
To access this tab, a user must have one of the following permissions: `TRAC_ADMIN`, `PERMISSION_ADMIN`, `PERMISSION_ADD`, `PERMISSION_REMOVE`. The permissions can granted using the `trac-admin` command (more on `trac-admin` below):
Then, the user `bob` will be able to see the Admin tab, and can then access the permissions menu. This menu will allow you to perform all the following actions, but from the browser without requiring root access to the server (just the correct permissions for your user account). Use at least one lowercase character in user names, as all-uppercase names are reserved for permissions.
1. [[Image(htdocs:../common/guide/admin.png)]] 1. [[Image(htdocs:../common/guide/admin-permissions.png)]] 1. [[Image(htdocs:../common/guide/admin-permissions-TICKET_ADMIN.png)]]
An easy way to quickly secure a new Trac install is to run the above command on the anonymous user, install the AccountManagerPlugin, create a new admin account graphically and then remove the TRAC_ADMIN permission from the anonymous user.
To enable all privileges for a user, use the `TRAC_ADMIN` permission. Having `TRAC_ADMIN` is like being `root` on a *NIX system: it will allow you to perform any operation.
Otherwise, individual privileges can be assigned to users for the various different functional areas of Trac (note that the privilege names are case-sensitive):
|| `BROWSER_VIEW` || View directory listings in the [wiki:TracBrowser] || || `LOG_VIEW` || View revision logs of files and directories in the [wiki:TracBrowser] || || `FILE_VIEW` || View files in the [wiki:TracBrowser] || || `CHANGESET_VIEW` || View [wiki:TracChangeset] ||
|| `TICKET_VIEW` || View existing [wiki:TracTickets] and perform [wiki:TracQuery] || || `TICKET_CREATE` || Create new [wiki:TracTickets] || || `TICKET_APPEND` || Add comments or attachments to [wiki:TracTickets] || || `TICKET_CHGPROP` || Modify [wiki:TracTickets] properties (priority, assignment, keywords, etc.) with the following exceptions: edit description field, add/remove other users from cc field when logged in, and set email to pref || || `TICKET_MODIFY` || Includes both `TICKET_APPEND` and `TICKET_CHGPROP`, and in addition allows resolving [wiki:TracTickets]. Tickets can be assigned to users through a [TracTickets#Assign-toasDrop-DownList] when the list of possible owners has been restricted. || || `TICKET_EDIT_CC` || Full modify cc field || || `TICKET_EDIT_DESCRIPTION` || Modify description field || || `TICKET_EDIT_COMMENT` || Modify comments || || `TICKET_ADMIN` || All `TICKET_*` permissions, plus the deletion of ticket attachments and modification of the reporter and description fields. It also allows managing ticket properties in the WebAdmin panel. ||
Attention: the "view tickets" button appears with the `REPORT_VIEW` permission.
|| `MILESTONE_VIEW` || View milestones and assign tickets to milestones. || || `MILESTONE_CREATE` || Create a new milestone || || `MILESTONE_MODIFY` || Modify existing milestones || || `MILESTONE_DELETE` || Delete milestones || || `MILESTONE_ADMIN` || All `MILESTONE_*` permissions || || `ROADMAP_VIEW` || View the [wiki:TracRoadmap] page, is not (yet) the same as MILESTONE_VIEW, see [trac:#4292] || || `ROADMAP_ADMIN` || to be removed with [trac:#3022], replaced by MILESTONE_ADMIN ||
|| `REPORT_VIEW` || View [wiki:TracReports], i.e. the "view tickets" link. || || `REPORT_SQL_VIEW` || View the underlying SQL query of a [wiki:TracReports] || || `REPORT_CREATE` || Create new [wiki:TracReports] || || `REPORT_MODIFY` || Modify existing [wiki:TracReports] || || `REPORT_DELETE` || Delete [wiki:TracReports] || || `REPORT_ADMIN` || All `REPORT_*` permissions ||
|| `WIKI_VIEW` || View existing [wiki:TracWiki] pages || || `WIKI_CREATE` || Create new [wiki:TracWiki] pages || || `WIKI_MODIFY` || Change [wiki:TracWiki] pages || || `WIKI_RENAME` || Rename [wiki:TracWiki] pages || || `WIKI_DELETE` || Delete [wiki:TracWiki] pages and attachments || || `WIKI_ADMIN` || All `WIKI_*` permissions, plus the management of readonly pages. ||
|| `PERMISSION_GRANT` || add/grant a permission || || `PERMISSION_REVOKE` || remove/revoke a permission || || `PERMISSION_ADMIN` || All `PERMISSION_*` permissions ||
|| `TIMELINE_VIEW` || View the [wiki:TracTimeline] page || || `SEARCH_VIEW` || View and execute [wiki:TracSearch] queries || || `CONFIG_VIEW` || Enables additional pages on About Trac that show the current configuration or the list of installed plugins || || `EMAIL_VIEW` || Shows email addresses even if [wiki:TracIni#trac-section] configuration option is false ||
To create custom permissions, for example to be used in a custom workflow, enable the optional [trac:ExtraPermissionsProvider] component in the "Plugins" admin panel, and add the desired permissions to the `[extra-permissions]` section in your [wiki:TracIni#extra-permissions-section]. For more information, please refer to the documentation of the component in the admin panel.
You grant privileges to users using [wiki:TracAdmin]. The current set of privileges can be listed with the following command:
This command will allow the user bob to delete reports:
The `permission add` command also accepts multiple privilege names:
Or add all privileges:
There are two built-in groups, "authenticated" and "anonymous". Any user who has not logged in is automatically in the "anonymous" group. Any user who has logged in is also in the "authenticated" group. The "authenticated" group inherits permissions from the "anonymous" group. For example, if the "anonymous" group has permission WIKI_MODIFY, it is not necessary to add the WIKI_MODIFY permission to the "authenticated" group as well.
Custom groups may be defined that inherit permissions from the two built-in groups.
Permissions can be grouped together to form roles such as developer, admin, etc.
Group membership can be checked by doing a with no further arguments; the resulting output will include group memberships. Use at least one lowercase character in group names, as all-uppercase names are reserved for permissions.
Permission groups can be created by assigning a user to a group you wish to create, then assign permissions to that group.
The following will add bob to the new group called beta_testers and then will assign WIKI_ADMIN permissions to that group. (Thus, bob will inherit the WIKI_ADMIN permission)
Permissions can be removed using the 'remove' command. For example:
This command will prevent the user bob from deleting reports:
Just like `permission add`, this command accepts multiple privilege names.
You can also remove all privileges for a specific user:
Or one privilege for all users:
By default on a new Trac installation, the `anonymous` user will have view access to everything in Trac, but will not be able to create or modify anything. On the other hand, the `authenticated` users will have the permissions to create and modify tickets and wiki pages.
anonymous
authenticated
See also: TracAdmin, TracGuide and TracFineGrainedPermissions