User Role and permissions...

Hi everyone,

I do not know where this post really belong but I thought this place would be the most appropriate, if not, well sorry...

I’m new to ModX and I like it. One thing though I think is not very well streamlined (imho) is the users role and permission system. Wouldn’t it be more convenient if the *Role* be tied to the *User Group* instead of the User itself, thus allowing a single user account to have different permission according to what document they handle rather than who they are. Thus eliminating the need for a single individual to have multiple user accounts for different level of permission.

I’m working on a project where several editorial committee each edit their own documents but only the head of those committee has expanded rights. One person could be Principal Editor of a specific committee (head of that committee) but simple editorial member of an other, but if his role is set as Principal Editor, he will end up having expanded editing right to all groups of documents, which he shouldn’t.

Is there a way around that dilemma with the current architecture of roles and permissions of ModX.

Thanks for any help.

Lionel

The way it’s set up to work in MODx as it is, user/document groups establish what the user can access, and roles establish what the user can do with the items he can access. It does have limitations in certain edge cases, but for the most part it’s a very practical arrangement. Almost any arrangement of access/permissions can be worked out, but I agree that there are certain cases where it is either very awkward or just not quite possible to do exactly what is wanted.

Thanks for that.

However, you don’t address my issue. Is there a way to let one user have different access privileges on different parts of a site using a single account?

I don’t know how difficult it would be and how much effort it would require to link the *Role* to the *User Group* instead of the User itself but I reckon this would greatly expand the user-permission management process and capabilities of MODx, allowing much more structured and logical combinations of setup. Any website relying on team-work procedure would certainly appreciate. I suppose that eventually this could be a stumbling block for MODx not being able to manage different access level for one given account.

But maybe I’m missing something here. If there is a way to do such a thing, can anyone help?

Lionel

Not with 096x or earlier. With 097 and beyond you can do exactly what you want and then some using the much-more-robust Attribute Based Access Control (ABAC) system.

Sounds good. So is 097 still in development or is it final release? Cause I downloaded MODx not long ago and 096 1p2 is what I got.

Cheers.

As I see, 097 is public alpha, so no-no for real world deployment. But what is the schedule for the final release? Can’t wait to get my hands on it...

Thanks.

To see it released earlier, download it, test it, and report bugs! Lots of info in the MODx Next topic.

I need to setup an other machine for that but yea, I’ll try to do that. Anyway, thanks a lot for your help and quick answers!

Cheers.

Does this mean 097 will give the administrator the ability to hide pages that are not accessible to a user? This to me is a very useful feature.

Quote from: scottishbullet at May 15, 2008, 07:07 PM

Does this mean 097 will give the administrator the ability to hide pages that are not accessible to a user? This to me is a very useful feature.

Some like it and others don’t, such as the situation where you want articles/blog entries editable by most but only an admin to have access to the container document. If the editors can’t see the containing documents, they can’t see where they can create them. Can be worked around of course and I actually think there’s an interfaceless setting for this contained in even the 0961 and above manager, but I can’t seem to find it right now.