The FlexWiki security implementation is complete and present in 2.0 builds of FlexWiki. Details about the security model can be found at FlexWikiSecurity.

Archived Discussion

The below requirements were gathered before work was completed. They are retained here for archival purposes.

• All UI layers must enforce the security (FlexWikiWeb, FlexWikiEditor, FwSync). Some of this will be enforced at the FlexWikiWebService layer.
• Current Windows Authentication based on NTFS folder security permissions should not be impacted
• Move Restore functionality from default.aspx to restoreversion.aspx. Thus it will be possible to implement unauthenticated reader / authenticated editor scenarios with Windows Authentication (rename.aspx and wikiedit.aspx are already there)
• Security enforced at the Namespace level
• Namespaces can be identified as being unsecured. Allowing anonymous access to the namespace for read/write operations.
• Types of permisions granted to users
• Read - View TopicNames
• Edit - Change or Create TopicNames
• Delete - Delete TopicNames
• Allow for unauthenticated readers / authenticated editors (based on the aforementioned permission set)
• Current None Authentication based installation should not be impacted.
• Administrators can configure Namespace security
• The FlexWikiWeb should support side bar login
• Users are identified by email address
• Users can change email address and password
• Users can request a lost password to be sent to their email
• It would be really nice to have an admin screen where we can enter IP addresses to deny. The rationale being a desire to keep a site open and unsecure, but keep out troublesome users. See the history at http://speech.squidnet.com/default.aspx/SpeechRecognition.IdentifierCache for an example
• a variation on this idea, would take more effort to implement but might yield better results. Instead of denying access to users at troublesome hosts, we could let them believe that their malicious edits were accepted, by sending them back their own pages, but sending back the real pages to everyone else.