Question

I am likely forgetting a setting somewhere, but after reviewing lots of docs, I'm stumpted. I have a comments tag: %COMMENT{type="bottom"} on a topic page, but when I try to add a comment, I am getting a message saying I don't have permission to %PARAM1% the topic. I am in the AdminGroup and the AdminGroup does have Web and Topic edit rights.

Environment

-- SusanCaskey - 23 Mar 2006

Answer

If you answer a question - or someone answered one of your questions - please remember to edit the page and set the status to answered. The status selector is below the edit box.

You have a lot of plugins installed there; I would personally disable the lot of them first, and verify that it's not another plugin causing the problem.

Assuming it still fails with all the other plugins disabled, can you describe how your permissions are set up?

-- CrawfordCurrie - 25 Mar 2006

Thanks for the idea. I've reduced my plugins to just these:

• CommentPlugin (Dakar, 8164): Allows users to quickly post comments to a page without an edit/preview/save cycle.
• EditTablePlugin (Dakar, 8154): Edit TWiki tables using edit fields, date pickers and drop down boxes
• IfDefinedPlugin (v0.90, $Rev$): Render content conditionally
• NatSkinPlugin (2.993, $Rev$): Supplements the bare bones NatSkin theme for TWiki
• RedDotPlugin (1.32, $Rev$): Renders edit-links as little red dots

And unfortunatly, no luck. I have tried using the comments plugin with both the natskin and with out the nat skin with the same general results.

I am a member of the TWikiAdminGroup, and this group has change and rename allow for all the web's I'm testing comments on. I am using subwebs, but I have tested comments on a web without anything funky (no subwebs or unusual skins). The error I get is:

Access Denied 
Attention 
Access check on WikiTestWeb.WebHome failed. Action "%PARAM1%": %PARAM2%. 
Contact sacaske@sandia.gov if you have any questions. 

WikiTestWeb's Perferences are as follows:

Set DENYWEBVIEW = Main.rmsalern 
#Set ALLOWWEBVIEW = 
#Set DENYWEBCHANGE = 
Set ALLOWWEBCHANGE = WikiTestGroup 
#Set DENYWEBRENAME = 
Set ALLOWWEBRENAME = WikiTestGroup 

Users or groups allowed to change or rename this WebPreferences topic: (e.g., TWikiAdminGroup) 
#Set ALLOWTOPICCHANGE = TWikiAdminGroup 
Set ALLOWTOPICRENAME = TWikiAdminGroup 

Just incase one of the other plugins that I think I do need was causing the problem, I disabled all but the comments plugin and retried adding a comment and did get the same results.

On the Unix side, all the files within the TWiki directory are owned by user www, whom apache is running as.

-- SusanCaskey - 27 Mar 2006

Some more details: I'm using the TWiki::Client::ApacheLogin for authentication, but it I change it to the twikiLogin, I still fail to add a comment, but instead of seeing %PARAM1% I do see "Change". With authentication set to None, I am seeing %PARAM1% again.

-- SusanCaskey - 27 Mar 2006

I don't see anything wrong with your setup. I just tried setting up the same sort of access restrictions in my test platform, and it all works fine.....

I assume you are rtying to add the comment to the WebHome topic, as suggested by the error message? And that there are no topic-level restrictions? I would be happier if you could disable the remaining plugins, esp. the last 3.

-- CrawfordCurrie - 28 Mar 2006

I have tried disabling all but the default plugins including those last three, with no impact.

I did some poking in the perl and I think I found part of the problem but I'm not really sure the solution. If I have a web with change permissions for my username of: sacaske, the comments will fail, but a normal edit/save works. My wikiusername is listed as Main.sacaske though, so I altered the WebPreference to be Main.sacaske and poof, comments work. But if I have changes allowed for a group, in this case its TWikiAdminGroup and the list of users in that group includes Main.sacaske it is still failing.

-- SusanCaskey - 28 Mar 2006

I'm surprised that you are specifying logins as "sacaske" rather than as "SusanCaskey".

How are you registering users?

-- MartinCleaver - 28 Mar 2006

Well, this is a bit of an odd install, neat, but odd. We are located on a kerberos enabled network and forced to use kerberos for all user based authentication. I am using the Apache-Kerberos module on my server along with the permissions inside my conf file and with the exception of the comments all seems to be working great. But becuase of all this I need to use our network uid's instead of wiki names for all my users.

-- SusanCaskey - 28 Mar 2006

Can you provide some more details, please. Is AllowLoginName set to 1 in your lib/LocalSite.cfg? Does Main.TWikiUsers list you as * SusanCaskey - sacaskey - <date>? What is the value of the AuthScripts variable in lib/LocalSite.cfg? Maybe it is a good idea to attach your LocalSite.cfg file here (sanitized). Did you edit TWiki.TWikiPreferences, Main.TWikiPrefefences or any other WebPreferences using the PreferencesPlugin? If so, then take a fresh copy of them from the distribution zip, disable the PreferencesPlugin and do your configuration steps again using normal "Edit".

-- MichaelDaum - 11 Apr 2006

Here is the LocalSite.cfg:

$cfg{LogDir} = $cfg{DataDir};
$TWiki::cfg{Password} = '';
$TWiki::cfg{Site}{Lang} = 'en';
$TWiki::cfg{LocalesDir} = '/usr/local/www/cgi-bin/TWiki-4.0.2/locale';
$TWiki::cfg{ScriptUrlPath} = '/twiki2/bin';
$TWiki::cfg{Site}{FullLang} = 'en-us';
$TWiki::cfg{PubUrlPath} = '/twiki2/pub';
$TWiki::cfg{PubDir} = '/usr/local/www/cgi-bin/TWiki-4.0.2/pub';
$TWiki::cfg{Site}{CharSet} = 'iso-8859-15';
$TWiki::cfg{RCS}{FgrepCmd} = '/usr/bin/fgrep %CS{|-i}% %DET{|-l}% -H -- %TOKEN|U
% %FILES|F%';
$TWiki::cfg{RCS}{EgrepCmd} = '/usr/bin/egrep %CS{|-i}% %DET{|-l}% -H -- %TOKEN|U
% %FILES|F%';
$TWiki::cfg{Site}{Locale} = 'C';
$TWiki::cfg{LogFileName} = '/usr/local/www/cgi-bin/TWiki-4.0.2/data/log2026-03-10.tx
t';
$TWiki::cfg{ConfigurationLogName} = '/usr/local/www/cgi-bin/TWiki-4.0.2/data/con
figurationlog.txt';
$TWiki::cfg{WarningFileName} = '/usr/local/www/cgi-bin/TWiki-4.0.2/data/warn%DAT
E%.txt';
$TWiki::cfg{DebugFileName} = '/usr/local/www/cgi-bin/TWiki-4.0.2/data/debug.txt'
;
$TWiki::cfg{DataDir} = '/usr/local/www/cgi-bin/TWiki-4.0.2/data';
$TWiki::cfg{TemplateDir} = '/usr/local/www/cgi-bin/TWiki-4.0.2/templates';
$TWiki::cfg{Plugins}{NatSkinPlugin}{Enabled} = 1;
$TWiki::cfg{Plugins}{IfDefinedPlugin}{Enabled} = 1;
$TWiki::cfg{Plugins}{FilterPlugin}{Enabled} = 1;
$TWiki::cfg{LoginManager} = 'TWiki::Client::ApacheLogin';
$TWiki::cfg{DefaultUrlHost} = 'https://domain.gov';
1;

I just upgraded to 4.0.2, and installed all new plugins and such, but I am having the exact same error. The only non-standard plugins are IfDefined and the NatSkin, which I have tested commenting without. My username is listed as Main.sacaske. I have not edited TWikiPreferences, only the WebPreferences for my Web, but if I add a COMMENT to the Main wiki I get the same error.

Thanks

-- SusanCaskey - 11 Apr 2006

Can you please show us the relevant line for your ID in your Main.TWikiUsers and confirm that the file data/Main/SusanCaskey.txt exists.

Also, what is the value of %WIKIUSERNAME% and %WIKINAME%

-- AntonAylward - 12 Apr 2006

I sure can... Within TwikiUsers my username is listed with all the others I bulk registered:

Access Control: 
Set ALLOWTOPICCHANGE = TWikiAdminGroup, TWikiRegistrationAgent 
sacaske - sacaske - 06 Apr 2006 

-rw-r--r--   1 www  www   2539 Apr 12 08:51 sacaske.txt
-r--------   1 www  www   3541 Apr 12 08:51 sacaske.txt,v

I am still using ApacheLogin with the apache kerberos_mod.

-- SusanCaskey - 12 Apr 2006

-- ArturoFicachi - 13 Apr 2006

I am having a very similar problem and I am also using Kerberos authentication. It seems to me that the mapping Twiki -> Kerberos is not working fine because when I go to TWiki, I am prompted for my user id (via Kerberos) and after validating the password, it lets me go into the main page but will show "HELLO LOCAL?" on the top left side as opposed to "HELLO Arturo Ficachi" as it shows in twiki.org. Thus, even though APACHE is authenticating me and letting me in, for twiki I am user LOCAL so it is not letting me go into the configuration page.

Some additional information:

The ID validated via Kerberos is: arturo.ficachi@mydomainPLEASENOSPAM.local

Under users, will display like this: arturo.ficachiMYDOMAIN.LOCAL - 13 Apr 2006

.httpasswd file shows like this: arturo.ficachiMYDOMAIN.LOCAL:ghG7hgy.UYT:arturo.ficachi@mydomain.com

Anybody had luck configuring TWiki to use Kerberos authentication?

-- ArturoFicachi - 13 Apr 2006

I realized that the parameter map user to twiki name was not set. Now it shows the user name in the top left part of the screen. I still can not access http://myserver/twiki/bin/configure

I will always sent me to the registration screen. Any clues?

-- ArturoFicachi - 13 Apr 2006