I've set up a TWiki on a private LAN (experimenting before moving to SourceForge). I have password authentication turned on (because I expect to use that when I move to SourceForge), but I have $doRememberRemoteUser turned off.

When I go to edit a page, the edit page clearly knows who I am -- it displays my username correctly (using %WIKIUSERNAME% on the template). When I save the page, the changes are attributed to TWikiGuest.

This is counterintuitive, to say the least. Is this the designed-in behavior, or is there a problem? Is it a problem in my setup or in the beta code?

If I set $doRememberRemoteUser, the problem does not occur, but I think that setting $doRememberRemoteUser should be unnecessary. (And, furthermore, subject to the problems described elsewhere with dynamic IP addresses.)

If this is not a problem, this behavior should be documented better -- once I understand the situation I can attempt to improve the documentation.

When I move the TWiki to SourceForge, how should I set the user authentication and related options?

• TWiki version: TWiki20010202beta
• Web server: Apache 1.3.14
• Server OS: Mandrake 7.2

-- RandyKramer - 28 Feb 2001

Answer

This is actually spec of basic authentication. If you authenticate the edit script, TWiki will get the user name from the REMOTE_USER env var. If you do not authenticate the view script, then you will get an empty REMOTE_USER variable, even the user has authenticated just before.

TWiki will remember the once loged in user name by enabling $doRememberRemoteUser. Note that this does not always work reliably as stated in the doc. Furthermore, SourceForge introduced some incoming proxy server a while ago, so this flag is of no use because all users seem to have the same IP address 198.186.203.33

The only reliable solution at SourceForge is to enable authentication also for the view script, but then you might turn away users because not everybody is willing to log in just to read content.

-- PeterThoeny - 05 Mar 2001

Im having the same problem on our intranet (not sourceforge). As Peter stated, you shouldnt be forced to login just to view the topics.

Is there any other way to solve this problem than restricting the view access? Remember this is our own site.

-- ErikMattsson - 31 Oct 2002