Thanks Amanda! .. It always looks so easy once a working solution is in place. My issues was that the "Users" and "Administrators" groups are referenced as "user" and "sysop" in the settings ... that wasn't super obvious at first, ha ha Got it. I understand that the '*' and 'user' groups can't be removed, but I did find that you can add and remove as all the rights from them as you wish from the methodology you described. Thank you! So first, I emptied the '*' group to have no rights except 'autocreateaccount'. This allows me to use Extension: Auth_remoteuser to automatically create their account and log them in, at which point they automatically become members of the 'user' group. Cool! So my next step was to remove --everything-- from the 'user' group. So that being auto-promoted by Auth_remoteuser to a 'user' doesn't give them any rights either. :-D My third step was to create a group called 'approved-user' and add all the rights to that group that I removed from the 'user' group. I did find that I had to explicitly add 'read' rights to the 'bureaucrat' group to even be able to continue to shuffle rights around, ha ha.. that was fun. Now I just need to figure out how to auto-add users to the 'approved-users' group when their session data qualifies them. That functionality you mentioned about 500 edits and 30 days is exactly what I'm referring to - except with different logic.. I'll research that next. Thank you!!! -Rich -----Original Message----- From: MediaWiki-l [mailto:mediawiki-l-bounces@lists.wikimedia.org] On Behalf Of Amanda Quad Sent: Thursday, November 02, 2017 9:28 AM To: MediaWiki announcements and site admin list Subject: Re: [MediaWiki-l] move basic user rights to custom groups for EMW I do believe that it is possible to auto-promote users to certain groups after certain conditions are met - however I’m not positive on the code required for this. I know that it is possible because the English Wikipedia auto-promotes accounts to “extended confirmed user” after the account has made 500 edits and has existed for 30 days. Unfortunately, I don’t think that it’s possible to completely unset the “user” or the “*” groups as these are implicit groups that would likely break MediaWiki without them. Essentially, any unregistered and logged-in user has to be able to at least do something - otherwise even you wouldn’t be able to login should you ever get logged out. — Amanda On Thursday, November 2, 2017, 9:18 AM, Evans, Richard K. (GRC-H000) <richard.k.evans(a)nasa.gov> wrote: A little more clarification...  I wish to: 1. remove all default rights from the group "users" (essentially saying, "being registered here doesn't grant you anything new") 2. create a group called "area1user" (which only grants "read" permissions to the custom namespace "area1") 3.  create a group called "area1editor" (which grants "edit" permissions to the custom namespace "area1") 4. do steps 2 and 3 for the "area2" namespace and other namespaces ...etc... Basically I wish for the "Main" namespace (and all the others) to appear to registered users who are not in an appropriate group to appear as if they are not registered at all... and allow Bureaucrats to manually add people to the appropriate groups. The next question would be.. is it possible to "auto-promote" users to certain groups based on conditional PHP code in Localsettings which has access to variables from the user's session header. -Rich -----Original Message----- From: Evans, Richard K. (GRC-H000) Sent: Thursday, November 02, 2017 8:55 AM To: mediawiki-l(a)lists.wikimedia.org Subject: move basic user rights to custom groups for EMW Hello, How can I remove a basic user right available to all by default (say, "editmyusercss") , and add it as a right only available to a custom group that only Bureaucrats can assign users to? Thank you. Ultimately, what I'm trying to do is for a private  enterprise mediawiki (EMW). I want to be able to allow all externally authenticated users visting my site to be autoregistered (autocreateaccount), but I want to authorize them to view content based on other session data available to me. My goal is to set my site up to deny all of the basic default privledges that come with merely being a registered user on the site and then to auto add users to specific custom groups based on additional identification data I get from the browser session header. I think I can do all this once I know how to create custom groups and remove default basic rights to the custom groups from the localsettings.php file. Then I can manually assign users to custom groups and work on being able to autoassign users to groups later. Thank you! -Rich _______________________________________________ MediaWiki-l mailing list To unsubscribe, go to: https://lists.wikimedia.org/mailman/listinfo/mediawiki-l _______________________________________________ MediaWiki-l mailing list To unsubscribe, go to: https://lists.wikimedia.org/mailman/listinfo/mediawiki-l