Question

We use TWiki in largish installation with about 5,000 registered users and about 28,000 topics spread across several dozen webs.

Due to SOX and export control regulations and other legal requirements, we need to have users automatically placed in overlapping sets of groups based on input from LDAP, say, or some other corporate database.

Some of these groups can be very large. For example, a group of company full-time employees might be much larger than 10,000 folks. The group of "north American" folks could approach 10,000.

I've read the various LDAP topics and looked at some of the TWiki code, and I'm not sure there is a good solution for this now.

For example, I understand that some LDAP servers do the inversion of groups such that you can ask which groups a user belongs to (instead of which users belong to a group) but I don't see any way that can be used by the TWiki access-control code except by modifying it.

What are the best-practices here?

Environment

-- RobertWithrow - 17 Jul 2007

Answer

If you answer a question - or someone answered one of your questions - please remember to edit the page and set the status to answered. The status selector is below the edit box.

This is a well known problem with TWiki, that has been addressed by SvenDowideit in his recent changes to the user management code. Unfortunately that code isn't available for 4.1.2, the most recently released TWiki, so you are right; the only way to do this is to invert the code. I have done this for a couple of clients, and it's not too complex, just fiddly. Alternatively, wait for 4.2 (you can accelerate it by contributing to the testing).

-- CrawfordCurrie - 18 Jul 2007

We'd love to contribute to the testing. Tell us how. URL, email, etc...

-- RobertWithrow - 24 Aug 2007