|
Groups are a specialized type of ad-hoc role used by the wiki system. Unlike
externally-provided roles (such as those provided by an LDAP server or web
container), JSPWiki groups can be created dynamically by wiki users, without
requiring special container privileges or administrator intervention. They
are designed to provide a lightweight role-based access control system that
complements existing role systems.
Group names are case-insensitive, and have a few naming restrictions, which
are enforced by the
GroupManager :
- Groups cannot have the same name as a built-in Role (e.g., "Admin",
"Authenticated" etc.)
- Groups cannot have the same name as an existing user
Note: prior to JSPWiki 2.4.19, Group was an interface; it
is now a concrete, final class.
Groups are related to
GroupPrincipal s. A GroupPrincipal, when
injected into the Principal set of a WikiSession's Subject, means that the
user is a member of a Group of the same name -- it is, in essence, an
"authorization token." GroupPrincipals, unlike Groups, are thread-safe,
lightweight and immutable. That's why we use them in Subjects rather than the
Groups themselves.
author:
Janne Jalkanen
author:
Andrew Jaquith
since:
2.3 |
