Changes for page XWiki Authentication and Access Control
Last modified by Agnease on 2026/05/25 12:52
Summary
-
Page properties (1 modified, 0 added, 0 removed)
Details
- Page properties
-
- Content
-
... ... @@ -8,11 +8,14 @@ 8 8 <i class="fa fa-lock" aria-hidden="true"></i> 9 9 XWiki authentication and access control 10 10 </div> 11 + 11 11 <h1 id="hero-title">Secure XWiki access, authentication and permissions</h1> 13 + 12 12 <p class="lead"> 13 13 Secure XWiki access with LDAP, Active Directory, SSO, OIDC, SAML, MFA, user synchronization, 14 14 group management and maintainable permission policies. 15 15 </p> 18 + 16 16 <div class="hero-actions"> 17 17 <a class="btn btn-primary" href="$xwiki.getURL('contact.WebHome')">Discuss access control needs</a> 18 18 <a class="btn btn-secondary" href="#access-control-process">See the approach</a> ... ... @@ -108,10 +108,12 @@ 108 108 <section class="services" aria-labelledby="access-needs-title"> 109 109 <div class="container"> 110 110 <h2 id="access-needs-title">Common authentication and access control needs</h2> 114 + 111 111 <p class="section-intro"> 112 112 Authentication and permissions often become more complex as XWiki grows. The right setup depends on your 113 113 identity provider, group structure, security expectations, user volume and internal administration model. 114 114 </p> 119 + 115 115 <div class="services-grid"> 116 116 #foreach ($entry in $accessNeedsItems) 117 117 <article class="service"> ... ... @@ -118,6 +118,7 @@ 118 118 <div class="service-icon" aria-hidden="true"> 119 119 <i class="fa fa-$entry.icon"></i> 120 120 </div> 126 + 121 121 <div class="service-body"> 122 122 <h4>$entry.title</h4> 123 123 <p>$entry.content</p> ... ... @@ -151,16 +151,19 @@ 151 151 <div class="split-grid"> 152 152 <div class="split-copy"> 153 153 <h2 id="process-title">A practical access control approach</h2> 160 + 154 154 <p> 155 155 Authentication and permissions should be handled with care because small configuration mistakes can affect 156 156 access to the entire platform. The goal is to understand the current setup, clarify the expected access 157 157 model and apply changes in a controlled way. 158 158 </p> 166 + 159 159 <p> 160 160 When possible, authentication and rights changes should first be validated in a staging or temporary clone 161 161 of the instance, especially when directory synchronization, group mappings, SSO or custom rights logic are involved. 162 162 </p> 163 163 </div> 172 + 164 164 <ol class="process-list"> 165 165 #foreach ($entry in $accessProcessItems) 166 166 <li> ... ... @@ -195,10 +195,12 @@ 195 195 <section aria-labelledby="areas-title"> 196 196 <div class="container"> 197 197 <h2 id="areas-title">Specific areas we can review</h2> 207 + 198 198 <p class="section-intro"> 199 199 Access control in XWiki is not limited to the login page. It includes the full chain from identity provider 200 200 to user synchronization, group membership, page permissions and application-level rules. 201 201 </p> 212 + 202 202 <div class="widgets"> 203 203 #foreach ($entry in $accessAreasItems) 204 204 <article class="widget"> ... ... @@ -206,6 +206,7 @@ 206 206 <i class="fa fa-$entry.icon"></i> 207 207 <h4>$entry.title</h4> 208 208 </div> 220 + 209 209 <p>$entry.content</p> 210 210 </article> 211 211 #end ... ... @@ -214,68 +214,92 @@ 214 214 </section> 215 215 216 216 ## IMPORTANT CONSIDERATIONS 217 - #set ($accessConsiderationItems = [{ 218 - 'title': 'Large directory performance', 219 - 'icon': 'tachometer', 220 - 'content': 'Large numbers of users and groups can create synchronization, login-time or permission-management challenges.' 221 - },{ 222 - 'title': 'Visibility of groups and users', 223 - 'icon': 'eye', 224 - 'content': 'Group display, permission screens and administration workflows should remain usable even with many directory groups.' 225 - },{ 226 - 'title': 'User provisioning strategy', 227 - 'icon': 'user-plus', 228 - 'content': 'Decide when users are created, how profiles are updated and how synchronization behaves after first login.' 229 - },{ 230 - 'title': 'Administrator access safety', 231 - 'icon': 'unlock-alt', 232 - 'content': 'Authentication changes should preserve reliable administrator access and avoid accidental lockouts.' 233 - },{ 234 - 'title': 'Upgrade compatibility', 235 - 'icon': 'refresh', 236 - 'content': 'Authentication extensions, configuration keys and security behavior should be reviewed during XWiki upgrades.' 237 - },{ 238 - 'title': 'Documentation and handover', 239 - 'icon': 'file-text-o', 240 - 'content': 'Access rules, configuration decisions and operational assumptions should be documented for future maintenance.' 241 - }]) 242 - 243 243 <section class="services" aria-labelledby="considerations-title"> 244 244 <div class="container"> 245 245 <h2 id="considerations-title">Important considerations</h2> 232 + 246 246 <p class="section-intro"> 247 247 Authentication and access control should be designed for both security and usability. A setup that is too 248 248 permissive creates risk, while a setup that is too complex becomes hard to operate and troubleshoot. 249 249 </p> 237 + 250 250 <div class="services-grid"> 251 - #foreach ($entry in $accessConsiderationItems) 252 - <article class="service"> 253 - <div class="service-icon" aria-hidden="true"> 254 - <i class="fa fa-$entry.icon"></i> 255 - </div> 256 - <div class="service-body"> 257 - <h4>$entry.title</h4> 258 - <p>$entry.content</p> 259 - </div> 260 - </article> 261 - #end 239 + <article class="service"> 240 + <div class="service-icon" aria-hidden="true"> 241 + <i class="fa fa-tachometer"></i> 242 + </div> 243 + <div class="service-body"> 244 + <h4>Large directory performance</h4> 245 + <p> 246 + Large numbers of users and groups can create synchronization, login-time or permission-management challenges. 247 + </p> 248 + </div> 249 + </article> 250 + 251 + <article class="service"> 252 + <div class="service-icon" aria-hidden="true"> 253 + <i class="fa fa-eye"></i> 254 + </div> 255 + <div class="service-body"> 256 + <h4>Visibility of groups and users</h4> 257 + <p> 258 + Group display, permission screens and administration workflows should remain usable even with many directory groups. 259 + </p> 260 + </div> 261 + </article> 262 + 263 + <article class="service"> 264 + <div class="service-icon" aria-hidden="true"> 265 + <i class="fa fa-user-plus"></i> 266 + </div> 267 + <div class="service-body"> 268 + <h4>User provisioning strategy</h4> 269 + <p> 270 + Decide when users are created, how profiles are updated and how synchronization behaves after first login. 271 + </p> 272 + </div> 273 + </article> 274 + 275 + <article class="service"> 276 + <div class="service-icon" aria-hidden="true"> 277 + <i class="fa fa-unlock-alt"></i> 278 + </div> 279 + <div class="service-body"> 280 + <h4>Administrator access safety</h4> 281 + <p> 282 + Authentication changes should preserve reliable administrator access and avoid accidental lockouts. 283 + </p> 284 + </div> 285 + </article> 286 + 287 + <article class="service"> 288 + <div class="service-icon" aria-hidden="true"> 289 + <i class="fa fa-refresh"></i> 290 + </div> 291 + <div class="service-body"> 292 + <h4>Upgrade compatibility</h4> 293 + <p> 294 + Authentication extensions, configuration keys and security behavior should be reviewed during XWiki upgrades. 295 + </p> 296 + </div> 297 + </article> 298 + 299 + <article class="service"> 300 + <div class="service-icon" aria-hidden="true"> 301 + <i class="fa fa-file-text-o"></i> 302 + </div> 303 + <div class="service-body"> 304 + <h4>Documentation and handover</h4> 305 + <p> 306 + Access rules, configuration decisions and operational assumptions should be documented for future maintenance. 307 + </p> 308 + </div> 309 + </article> 262 262 </div> 263 263 </div> 264 264 </section> 265 265 266 266 ## RELATED SERVICES 267 - #set ($relatedServiceItems = [{ 268 - 'title': 'XWiki Support & Maintenance', 269 - 'url': 'services.xwiki-maintenance-support', 270 - 'content': 'Ongoing support for production environments, including troubleshooting, maintenance planning and operational review.', 271 - 'linkLabel': 'View support services' 272 - },{ 273 - 'title': 'XWiki Security Review', 274 - 'url': 'services.xwiki-security-review', 275 - 'content': 'Security-aware review of versions, extensions, rights, scripting, authentication and upgrade exposure.', 276 - 'linkLabel': 'View security review' 277 - }]) 278 - 279 279 <section class="resource-strip" aria-labelledby="related-title"> 280 280 <div class="container"> 281 281 <h2 id="related-title">Related XWiki services</h2> ... ... @@ -285,13 +285,21 @@ 285 285 </p> 286 286 287 287 <div class="resource-grid"> 288 - #foreach ($entry in $relatedServiceItems) 289 - <article class="resource-card"> 290 - <h4>$entry.title</h4> 291 - <p>$entry.content</p> 292 - <a href="$xwiki.getURL($entry.url)">$entry.linkLabel</a> 293 - </article> 294 - #end 324 + <article class="resource-card"> 325 + <h4>XWiki Support & Maintenance</h4> 326 + <p> 327 + Ongoing support for production environments, including troubleshooting, maintenance planning and operational review. 328 + </p> 329 + <a href="$xwiki.getURL('services.xwiki-maintenance-support')">View support services</a> 330 + </article> 331 + 332 + <article class="resource-card"> 333 + <h4>XWiki Security Review</h4> 334 + <p> 335 + Security-aware review of versions, extensions, rights, scripting, authentication and upgrade exposure. 336 + </p> 337 + <a href="$xwiki.getURL('services.xwiki-security-review')">View security review</a> 338 + </article> 295 295 </div> 296 296 </div> 297 297 </section>