Revo Permissions

After my incessant complaining about the Revo persmissions system @JayGilmore requested that I, "share with me the use case you are working out in the MODX forums?". It’s almost embarressing the amount of difficulty I have had in learning to manage the Revo permissions system on even a very basic level. To date I have only attempted the simplest of tasks and have found the system extremely difficult to manage. I realize that the system is robust, but tapping into that power is proving very, very difficult. So, per Jay’s request I am creating this post hoping it will provide some useful user feedback. I hope this provides something of value to the MODx team.

In my example I have my Super User (0) account and a Site Admin (9999) account. I want to hide a few documents from the Site Admin like the XML sitemap and the Error document. I also like to use the Form Customization process to hide fields from the Site Admin view.

I create a Resource Group (Super Admin Only) to drag the hidden files into.

In Access Controls I create a User Group (Site Admin). (At this point you right click to Update User Group, this is not intuitive), I then add my Site Admin user to this group. Next I create a mgr and a web access (Member - 9999) apply an access policy of Content Editor, but the Content Editor needs editing so once I hit save I go to that section.

In Access Controls->Access Policies I update the appropriate policy permissions. (Now which User Group am I doing this for??)

Now, I have to go back to Access Controls to edit the Administrator User Group (At this point you right click to Update User Group, this is not intuitive). I need to edit Resource Group Access. Resource Group - Admin Only, Minimum Role - Super User (0), Access Policy - Load, List, View, Context - mgr

Now, I go to Form Customization (I am not critiquing the Form Customization process, it has been greatly improved). Create a Profile then Edit it (At this point you right click to the Profile, this is not intuitive) and in addition to creating a resource/update and resource/create set I add the Site Admin User Group

Now, I am happy I am done. But wait, when I navigate to a document in the Super Admin Only Resource Group as the Super Admin it says I do not have permission to edit this document. What feedback do I have? Other than the previous statement - none. Where in the previous 10+ steps of drilling down and back up do I begin to troubleshoot this? There is no overview of what I have just done/created or much in the way of feedback to point me in the right direction.

The answer is that when I edited my Resource Group Access the Access Policy for the Administrator User Group it should have been Resource instead of Load, List, View. I can’t tell that that’s the issue by drilling directly down to and looking in the Resource Group Access, I have to go Access Controls->Access Policies and do a side-by-side review of both of the policies. Now, I return to original Resource Group Access (Now which User Group am I doing this for??) and correct the access policy.

I guess I am trying to demonstrate how difficult this system is to effectively manipulate. It’s like the the Resource Groups, User Groups, Roles and Access Policies are each a leg of a table. Each one important and necessary. The problem is that each leg is hidden from from the others as you drill up and down through so many levels.

I get it that it’s frustrating, and we definitely agree. How would you propose it be reworked? Actually, how would anyone propose it be reworked? We’d love to make a change that makes this more simple and intuitive!

Quote from: pleth at May 16, 2011, 03:20 PM

It’s like the the Resource Groups, User Groups, Roles and Access Policies are each a leg of a table. Each one important and necessary. The problem is that each leg is hidden from from the others as you drill up and down through so many levels.

That is definitely true. As I’ve tried to illustrate with the diagram, it’s all linked together but it needs to be visible somehow on *how* they are linked.


One major error on the Documentation part which you seem to touch on is what the built in access policies actually do and give access to. Even I wouldn’t know from the top of my mind what each one is and is not allowed to do, I typically just duplicate the Adminstrator or Resource policy one and start unticking what I don’t want the user to do.

Mark,

The Duplicate and UnCheck strategy is one that typically gets used most frequently. For Manager users it is certainly the one to start with. It is when you get into combinations of web users and manager users or more singular use cases for the Manager access to groups etc that this becomes quickly difficult.

Definitely true...

How could it be simplified, without losing the granularity of the system though?


List of random thoughts that I literally just came up with that could improve certain parts of the security in one way or another. In no way are these thought out and ready to implement.

- More inline help?
- A link "View permissions" next to the access policy et al which opens another modal box listing the granted permissions?
- Or a "View as user" feature (MyBB has that to show what forums are visible/postable with certain groups)?
- What about an image in the docs with a manager screenshot where the permissions involved are highlighted in certain functionality?
- Perhaps allow duplicating user groups would be a good new feature, which makes it easier to copy the permissions and work top-down to permissions you want it to have? It’s easier to remove an ACL from a pre-filled form for disallowing a resource group compared to adding it, so to speak. I think this would make it a lot easier!

Also, I’ve not tested this recently, but do administrators automatically get role 0 access to any created resource groups/categories? If not, it should.

Export and import acl user settings and groups would be a good thing.

Quote from: Mark at May 16, 2011, 04:35 PM

- What about an image in the docs with a manager screenshot where the permissions involved are highlighted in certain functionality?

Having a single location to visualize the site security structure might be valuable.

I would like to be able to click on a resource and then see a grid of all the users in the system, and whether or not they can interact with that resource (and how they can interact).

For instance, you click on a resource’s "security tab" and see that:

Fred - has no permission (details...)
Mary - has no permission (details...)
Bob - has some permissions (details...)

(Or you can filter the list to specifically examine the "view" permission or the "edit" permission, etc.)

When you click on the "details..." link, it shows you the detail of the connection (or lack of connection) between user and resource, helping you debug why a user can or cannot see a particular resource.

Similarly, I would also like to be able to click on a user and then see a grid of resources and whether or not they can interact with that resource (and how they can interact).

I like to see the permisissions in sub categories instead of alphabetic. like the modx settings.

Hello;

I’ve posted this looking for some help about modx revo permissions earlier today.
http://modxcms.com/forums/index.php/topic,64586.msg365331.html#msg365331

As a newbie modx user in early steps i can say it can get really frustrating in this topic.
Checked the docs, tutorials, forum posts, yet couldn’t accomplish the thing. Still without feedback

Maybe more experienced modx devs can’t feel the difficulties because they are used to the process already, but the interface needs clarification.
Also I’ve found you commonly use the ’ACLs’ in abbreviation for Access Control Lists but that phrase is not used in the interface.

• Took me a lot of time to understand that ACLs are (using my words here) ’permissions configurations’
  that can be achieved combining context, user groups, roles and access policies. They are not a ’named’ tab in the security section.
• Also some help about which policy template type to duplicate (Admin, Resource, Element, Object) in different scenarios and if we really need a new one.
• I think the column ’Template Group’ in the Policies Templates tab can be renamed to Template Type as we have User Groups, Resource Groups, it can be confusing
• Access Control / User Groups, Right Click, Update Group is the place where you link all these relations, as few have said, a bit counter-intuitive. Maybe a Grid view with a button at the right (like package management, download extras one) will be easier to use and understand

Hope it helps.
Found MODX Revo as the better solution out there for its flexibility and web layers separations and im here to stay , Glad to help at least with suggestions from a newcomer point of view.

Pablo.