MODx (Revo) Permissions Confusing the **** out of me

Ok, so I’ve read the documentation, tried to implement things about 20 times and I’m just not getting the setup I want....so I’m hoping someone can help to explain to how how I do this:

Create a user who can only edit one page where all pages should be publically viewable to anyone, reagrdless of who they are logged in as.

That’s all I want to do!

I’ve been able to create a new user, add that user to a new user group and give that use the ability to log into the manager....

I have tried setting up resource groups with just that page and assigning it to the administrators user group and a new user group with just the new user in.

Then I removed this resource group tried putting all the pages other than just this one resource in another resource group and only only assigning that to the Administrator’s user group. When I do this the new user can’t see any public page other than this one page!

Then, to make things worse, a previous developer added an "Editor" Role, assigned this to an "editor" user within the "Administrator"’s user group - and for some reason this user can now only see one page when logged into the manager.

I’ve watched SM’s screen cast on the official docs page
I’ve read Bob’s guide to revo permissions

And, although the theory makes some sense - I’m just not seeing it in practise and cannot for the life of me work out why?!?!?

(PS I’m using 2.0.4-pl2)

It is difficult to get your head around, yes. I will probably get some of this wrong, but I have just test-cased your issue - the main issue appears to be excluding that user from being able to edit other resources:

1. I created a new resource - for argument’s sake I called it ’Locked’
2. In Security - Resource Groups, I created a new resource group - also called Locked.
3. I dragged ’Locked’ resource into ’Locked’ resource group. (I could also do this by opening ’Locked’ and checking ’Locked’ on the Access Permissions tab).
4. I created a new user - in my example I called him edmin (I also created another user called ’udmin’ for further testing)
5. I created a new user role - Editor (value 1000).
6. I created a new user group - Editor.
7. I added Edmin to that group with role Editor. (I also added Udmin as a mere Member)
8. I _duplicated_ the Admin policy and called it Editor-Admins. For proof-of-concept I removed the ’element tree’ permission.
9. I updated the user group Editors to have the following:
9a. Context access - for both Mgr and Web I specified that any Member of the Editor group could have access.
9b Resource Groups - I added ’Locked’ to both web and mgr contexts - important - I set the minimum role as ’Editor’.
10. I flushed permissions (and cleared the cache for good measure).

In a new browser, I logged into my manager as Edmin
* He can see Resources and Files, including the resource called ’Locked’
I logged out
In that same browser I logged into my manager as Udmin
* He can see Resources and Files, BUT NOT the resource called ’Locked’.

Two further points to note:
* You will need to give your Administrator group access to the Resource Group ’Locked’ or it will not appear in your resource tree either.
* There is, as far as I can tell, no way to apply ’exclude’ permissions - ie in order for Edmin to ONLY be able to edit ’Locked’ and not see any other resources, ALL other resources would need to be in a resource group that he doesn’t have access to. This might be a misunderstanding of mine, or there may be a clever way around it.

And one untested scenario:
You might need to update your Anonymous user group in order to see the Locked resource when not also logged in to the manager - giving them the Load Only access policy for web and that resource group should be enough.

Hope this helps (and BobRay’s the proper expert in this field, I’m just trying to understand it better myself, hence sticking my oar in).

Oh - and obviously the Edmin-Admin Access Policy I created is ridiculously overpowered for what that user needs to do, but as BobRay’s tutorial says, it’s easier to start off superuser and shave off unwanted permissions, than only add the actual permissions required (which I’m not sure have been listed anywhere properly, yet, for this scenario of ’simple’ editor users).

Thanks!

I’ll give that a try (I would have tried earlier but I didn’t know you’d replied - I was expecting an email notification but didn’t get one )

odeclas’ steps look good to me. I’m not sure I understand exactly what you want, but there might be a somewhat easier way. You can limit the user’s view of the tree with a tree_root_id user setting.

Go to Security -> Manage Users
Right-click on the user and select "Update User"
Click on the "Settings" tab.
Click on the "Create New" button.
Enter these values:

Key: tree_root_id
Name: Tree root ID
Value: (id of the user’s page).

Click on the "Save" button.

That will hide everything from that user but the single page and will have no effect in the front end.

You’ll also want to:
Duplicate the Administrator policy (Security->Access Controls -> Access policies tab)
On the User Groups tab add the user to the Administrator group with their own role.
On the User Groups tab, right-click on the Administrators user group (Update) create a Context Access ACL entry for that user’s group with a context of mgr and the duplicate policy and minimum role of the user’s role.
In the same place create a Context Access ACL entry for that user’s group with a context of web, the user’s role as the minimum role, and the resource policy.

That will let the user log in and see the file in the resource tree and shouldn’t affect anyone else or the front end at all (make sure it’s working before the next step).

Now, you need to edit that duplicate Administrator policy you created to remove things like access_permissions, element_tree, file_tree -- anything the user shouldn’t be able to do (this will be a lot easier in MODx 2.0.5, BTW, since you’ll just be unchecking checkboxes). Be sure to leave load, list, view, and edit documents.

Hi from,

i have same problem ( )

i created new context with name ’staff’ and resources in that context, and i want to give permission to edit files in ’staff’ for staffuser, where staffuser can see only files from that context.

I read tutorials and try...but does not working...

do you have any idea for this...

sorry for bad language

Oh...thanks God...i fix that...
Now everything works as expected,
staffuser see only their own resources and from other contexts see only headlines ... I will try to paying in advance so that you do not see staffuser and other contexts (small houses)