View source for User rights management

# User Rights Management

User rights management is a critical aspect of maintaining a secure and functional [[wiki]]. It determines what actions users can perform on the wiki, ranging from simple page viewing and editing to administrative tasks like blocking users or modifying wiki configuration. This article provides a comprehensive guide to understanding and managing user rights in MediaWiki 1.40, targeted towards beginners.  Properly configured user rights are essential for preventing vandalism, maintaining content quality, and ensuring the overall stability of your wiki.

== Understanding User Groups

MediaWiki utilizes a group-based permission system. Instead of assigning individual rights to each user, users are assigned to groups, and each group is granted a set of predefined permissions. This simplifies administration and makes it easier to manage access control. Here’s a breakdown of the most common user groups in a standard MediaWiki installation:

* **Users:**  All registered users belong to this group. They typically have the right to read pages, contribute to their [[user talk page]], and edit pages (depending on any restrictions in place).
* **Authenticated Users:** This group includes all logged-in users. It often has slightly more permissions than the 'Users' group, such as the ability to upload files (if enabled).  This is a useful group for granting privileges to all registered users without affecting anonymous users.
* **Bureaucrats:** This is the highest level of user group. Bureaucrats can grant and revoke all user rights, including the ability to become a Bureaucrat themselves.  They have complete control over user permissions.
* **Administrators (Sysops):** Administrators have extensive rights, including deleting and undeleting pages, protecting pages, blocking users, and managing site settings. They are responsible for the day-to-day maintenance of the wiki.
* **Moderators:**  Moderators typically have the ability to review and approve edits, particularly important for wikis with open editing.  They can often also delete revisions and manage page protection.
* **Rollbackers:** Rollbackers have a specialized right to quickly revert edits, making them effective at combating vandalism.
* **Editor:** Users in this group typically have increased editing capabilities, often including the ability to edit semi-protected pages.
* **Confirmed:**  Users who have proven they are not bots or disruptive editors are often automatically assigned to this group. This group often has increased privileges, such as the ability to edit semi-protected pages.

These are the default groups.  Administrators and Bureaucrats can create custom user groups to tailor permissions to specific needs.  For example, a wiki dedicated to a specific subject might create a "Subject Expert" group with permissions to approve edits related to that subject.

== Accessing the User Rights Management Interface

The user rights management interface is accessible to Bureaucrats and Administrators.  The exact location may vary slightly depending on your wiki's configuration, but it is usually found under:

* **Special:UserRights:** This page provides a comprehensive interface for managing user rights.
* **Special:ListUsers:**  This page allows you to search for users and then manage their rights.
* **User:Username:** Navigate to a specific user's user page and look for a "user rights" or similar tab (if enabled in your wiki's configuration).

== Managing User Rights: A Step-by-Step Guide

Let's walk through the process of managing user rights using the `Special:UserRights` page:

1. **Login:** Log in to the wiki as a Bureaucrat or Administrator.
2. **Navigate to Special:UserRights:** Type `Special:UserRights` in the search bar or click on the corresponding link in the Special Pages list.
3. **Enter Username:** In the "User name" field, enter the username of the user whose rights you want to modify.
4. **Select Groups:**  A list of available user groups will be displayed.  Check the boxes next to the groups you want to add the user to.  To remove a user from a group, uncheck the corresponding box.
5. **Save Changes:** Click the "Set user rights" button to save the changes.

The interface will clearly indicate which groups a user currently belongs to. Be cautious when adding users to powerful groups like Administrator or Bureaucrat, as incorrect assignments can compromise the security of your wiki.

== Understanding Individual Rights

While user groups are the primary method of assigning permissions, MediaWiki also allows for the granting of individual rights. These rights can be assigned to users *in addition* to their group memberships.  Some commonly used individual rights include:

* **`editprotected`:**  Allows a user to edit fully protected pages.
* **`editsemiprotected`:** Allows a user to edit semi-protected pages.
* **`createsheets`:** Allows a user to create new stylesheets.
* **`createscripts`:** Allows a user to create new JavaScript scripts.
* **`revisionsdelete`:** Allows a user to delete revisions of pages.
* **`browsearchange`:** Allows a user to browse the change history of pages without being able to edit them.
* **`skipcaptcha`:** Allows a user to bypass the CAPTCHA challenge. (Use with caution!)

Individual rights are assigned in the same `Special:UserRights` interface.  Scroll down past the group selection to find the section for individual rights.  Check the box next to each right you want to grant.

== Best Practices for User Rights Management

* **Principle of Least Privilege:**  Grant users only the rights they absolutely need to perform their tasks. Avoid over-privileging users.
* **Regular Audits:**  Periodically review user rights to ensure they are still appropriate. Users may no longer need certain privileges if their roles have changed.
* **Documentation:**  Maintain clear documentation of your wiki’s user group definitions and the permissions associated with each group.
* **Two-Factor Authentication:**  Encourage or require all administrators and bureaucrats to enable two-factor authentication for enhanced security.
* **Monitor User Activity:**  Regularly monitor user activity, especially for users with elevated privileges.  Pay attention to unusual or suspicious behavior.
* **Accountability:**  Establish clear accountability for administrators and bureaucrats.
* **Training:** Provide training to administrators and bureaucrats on proper user rights management procedures.
* **Avoid Direct Bureaucrat Assignments:** Limit the number of users with Bureaucrat rights. This is the most powerful group and should be reserved for highly trusted individuals.
* **Use Custom Groups:** Leverage custom user groups to create more granular control over permissions.
* **Consider Extension Security:**  If you are using extensions, review their documentation to understand any additional user rights they require.

== Troubleshooting Common Issues

* **User Cannot Edit Pages:** Ensure the user is in the appropriate group (e.g., Users, Authenticated Users) and that the page is not protected. Check if they have the `editsemiprotected` or `editprotected` rights if the page is semi-protected or fully protected, respectively.
* **User Cannot Upload Files:**  Ensure the user is in the Authenticated Users group (or a custom group with upload privileges) and that file uploads are enabled in the wiki’s configuration (`$wgEnableUploads`).
* **User Rights Not Updating:**  Clear your browser cache and try again.  If the problem persists, check the MediaWiki error logs for any related messages.
* **Incorrect Permissions:** Carefully review the user's group memberships and individual rights.  Make sure you haven't accidentally granted them unintended permissions.

== Advanced Considerations

* **Rights Management Extensions:** Several extensions can enhance user rights management capabilities. These include:
    * **GroupRights:** Provides more fine-grained control over group permissions. [https://www.mediawiki.org/wiki/Extension:GroupRights]
    * **UserMerge:** Allows merging user accounts and consolidating their rights. [https://www.mediawiki.org/wiki/Extension:UserMerge]
    * **CentralAuth:** Enables single sign-on across multiple wikis and centralizes user account management. [https://www.mediawiki.org/wiki/Extension:CentralAuth]
* **API Access:** User rights management can also be automated using the MediaWiki API. This is useful for larger wikis with complex user management requirements. [https://www.mediawiki.org/wiki/API:Userrights]
* **Database Manipulation (Caution):**  Directly manipulating the user rights table in the database is strongly discouraged unless you are an experienced MediaWiki administrator. Incorrect modifications can severely damage your wiki.

== Staying Updated

The MediaWiki project is constantly evolving.  Stay informed about new features and security updates by:

* **Consulting the MediaWiki Documentation:**  [https://www.mediawiki.org/wiki/Manual:User_rights]
* **Following the MediaWiki Release Notes:** [https://www.mediawiki.org/wiki/Release_notes]
* **Participating in the MediaWiki Community:** [https://www.mediawiki.org/wiki/Community]

Understanding and effectively managing user rights is crucial for maintaining a secure, collaborative, and well-functioning wiki. By following the guidelines outlined in this article, you can ensure that your wiki is protected from vandalism and misuse, while empowering your users to contribute effectively.  Remember to prioritize the principle of least privilege and regularly review user rights to maintain a secure environment.

[https://en.wikipedia.org/wiki/Access_control] Access Control
[https://en.wikipedia.org/wiki/Role-based_access_control] Role-Based Access Control
[https://owasp.org/www-project-top-ten/] OWASP Top Ten
[https://csrc.nist.gov/csrc/risk-management] NIST Risk Management Framework
[https://www.sans.org/security-awareness-training/] SANS Security Awareness Training
[https://www.iso.org/isoiec-27001-information-security.html] ISO 27001 Information Security
[https://www.cloudsecurityalliance.org/] Cloud Security Alliance
[https://www.cert.org/] CERT Coordination Center
[https://www.ncsc.gov.uk/] National Cyber Security Centre (UK)
[https://www.cisa.gov/] Cybersecurity and Infrastructure Security Agency (US)
[https://www.first.org/] Forum of Incident Response and Security Teams
[https://www.trustwave.com/] Trustwave Security
[https://www.verizon.com/business/security/] Verizon Security
[https://www.symantec.com/] Symantec Security
[https://www.mcafee.com/] McAfee Security
[https://www.kaspersky.com/] Kaspersky Security
[https://www.trendmicro.com/] Trend Micro Security
[https://www.fireeye.com/] FireEye Security
[https://www.crowdstrike.com/] CrowdStrike Security
[https://www.paloaltonetworks.com/] Palo Alto Networks Security
[https://www.fortinet.com/] Fortinet Security
[https://www.cisco.com/c/en/us/products/security/index.html] Cisco Security
[https://www.microsoft.com/en-us/security] Microsoft Security
[https://www.ibm.com/security] IBM Security
[https://www.splunk.com/en_us/security.html] Splunk Security
[https://www.rapid7.com/] Rapid7 Security
[https://www.qualys.com/] Qualys Security
[https://www.tenable.com/] Tenable Security

[[Category:MediaWiki Administration]]

== Start Trading Now ==
[https://affiliate.iqbroker.com/redir/?aff=1085&instrument=options_WIKI Sign up at IQ Option] (Minimum deposit $10)
[http://redir.forex.pm/pocketo Open an account at Pocket Option] (Minimum deposit $5)
=== Join Our Community ===
Subscribe to our Telegram channel [https://t.me/strategybin @strategybin] to receive:
✓ Daily trading signals
✓ Exclusive strategy analysis
✓ Market trend alerts
✓ Educational materials for beginners