Managing Account Creation

How to prevent users from creating their own accounts

A frequently asked question on the the mailing lists is how to manage user-creation. This can be achieved by combining several Moin features together. This information is already in the documentation, but concatenated here more concisely as a FAQ item.

Use this scenario if you want only administrators to be able to create user accounts. This can be useful, for example, for small organizations and you don't want outside readers to create or edit pages.

• Note: there is an another page using alternative methods (requiring more code editing) described here: Disable User Account Creation. Review both pages and decide which will work better for you.

Set a CMS theme

This first step is mainly cosmetic. Setting your default theme to a "CMS"(Content Management System) theme will hide certain elements like edit links, page tools, and such from anonymous users until they are logged in. Moin includes modernized_cms already, and many themes also include a CMS version as well, such as Moniker (apologies for the self-promotion ), FixedLeft, and others.

In your wikiconfig or farmconfig.py file, find and change the theme directive as:

    theme_default = 'modernized_cms'
    theme_force = True

see also: ThemeMarket

Configure your wikiconfig.py

Give yourself full administrative privileges. In the same wikiconfig.py file, find the permissions section and edit, similar to this. For example, if your login name is "JoeAdmin", then:

•   acl_rights_before = u"JoeAdmin:read,write,delete,revert,admin"
    acl_rights_default = u"TrustedGroup:read,write,revert  All:read"

In the above example, we've added ourselves as admin in the "rights_before" which will ensure we always have full permissions. The second line, we allow our TrustedGroup to create and edit pages (we'll cover TrustedGroup below). The second part of that line, we allow any visitors to read with All:read.

If you wanted to make this a private wiki where anonymous users cannot even read pages without logging in, simply change the All:read statement to All:

see also: HelpOnAccessControlLists

Set up Textchas

Using Textchas, we can set up a "master" password that only we will know. Because the newaccount macro asks for a Textcha, we can easily use this to set up a password-like question that only we would know. Don't let this password get out!

Within your wikiconfig.py:

    textchas = {
        'en': {
            u"What is the Admin password?": ur"(SuperSecretPassword)",
        },
    }

    textchas_disabled_group = u"TrustedGroup"

see also: HelpOnSpam and TextCha

Set up a users group

Create a new page called TrustedGroup. This page should contain the entries of all the users who are allowed to use the wiki. On this page, each users' login name should be listed in bulleted form, like this:

• #acl TrustedGroup:read,write,delete,revert
   * BugsBunny
   * MickeyMouse
   * MinnieMouse
   * FredFlintstone

see also: HelpOnGroups

That's it! Internet surfers can now read your pages, but they won't be able to create accounts to edit them!