Taking MODx Security to the next level

TP3 will probably be herald as the most significant and secure update since the original release of the MODx.

Two new features that I’m proposing for TP3 is the ability to assign Roles to user groups and the ability to assign Special Access to individual users


Assigning Roles to Groups:
-----------------------------
Let’s say we have four users Mary, John, Ann and Paul.
Mary, John and Ann are all assigned to the User Role but we want also assign mary to the Power User Role. How can we do this?

We could create two groups called "Users" and "Power Users". The "Users" group would be assigned to the User role while the "Power Users" group would be assign to the "Power User" role. Using this setup any user we assign to the "Power Users" group will inherit the Power User role access permissions.


Assigning Special Access to users:
-----------------------------------
Another very powerful feature proposed is the ability to add special access to individual users.

Let’s say Mark, Pam, and Kim are all administrators but we do not want to grant Paul access to be able to delete documents or users. How can we do this? Well, currently we would have to create a separate Role just for Paul which might be a little bit awkward for some Site Administrators especially if they have to do this for more than one users.

The idea behind Special Access is that we will be able to grant or deny individual access to manager users. This means that Special Access permissions will be given precedence over User and Group assigned role access permissions. Special Access permissions will have one of three states: 1 - unassigned, 2 - Allowed, 3 - Deny.

In Paul’s case all we have to do is to deny paul access to "Delete Documents" and "Delete Users" and we are done. No matter what role he’s assigned he will not be able to delete documents or users.


IMO these two features will add another level of flexibility to the MODx’s security stucture. What do you think? Should we add these features?

Definitely! Given that a person can be members of multiple groups, they would get multiple roles. How would conflicts be resolved between them?

For instance how would a person that’s a member of two groups, one of which gets delete permissions and one of which doesn’t, be able to delete: yes or no?

Quote from: rthrash at Jul 01, 2005, 11:07 AM

For instance how would a person that’s a member of two groups, one of which gets delete permissions and one of which doesn’t, be able to delete: yes or no?

:) The role that has the access permission assigned (or active) will be given precendence. This is like comparing (ORing) two binary strings 100010 and 110010 the result would be 110010

Only the Special Access section will be able to deny access permissions

Cool... that makes perfect sense. Great Solution.

Would this also allow (down the road) things like front-end access only and back-end access only? Ideally there will be users who only need to create/edit documents via in-place editing and never need to access the site tree.

Quote from: davedenis at Jul 01, 2005, 11:27 AM

Would this also allow (down the road) things like front-end access only and back-end access only?? Ideally there will be users who only need to create/edit documents via in-place editing and never need to access the site tree.

IMO I think it will be flexible enough to allow many additions for future releases.

I think we have enough features packed into TP3 as is so I’ll hold off on this one for TP4.

IMO I think the custom content type feature should be able to ignite a few topics on the forums.