Revolution Permissions

Quote from: BobRay at Jan 21, 2010, 01:06 PM

Ok, let me see if this will fly.

A user group has a context access ACL that gives mgr context access and a policy without access_permissions
The same user group has another context access ACL that gives web context access *with* access_permissions.

Those users can’t access permissions in the Manager but can do so using a front-end tool?

That’s correct. Those Policies are tied to a specific Context, so a User can have different Permissions in each Context.

Excellent. If that was wrong, it would have ruined my day.


What is the context when previewing pages from the Manager?

Quote from: OpenGeek at Jan 21, 2010, 09:29 AM

Quote from: goldsky at Jan 20, 2010, 10:59 PM

Does Revo also allows grain permissions for individual Component?
I assume that component is similar with module in evo, which at the current release doesn’t have any individual permission attached to each module.

Yes, you can design policies with custom permissions that relate to custom Component actions. These can then be attached to contexts just like any other Context policy.

As a Namespace?

Am I right that Resource Groups is not a mandatory?
It is a mandatory, where user groups will be applied onto it from the Resource Group Access.

This whole thread has me really confused now! :/

All i want to do is have a front end login with some page restrictions according to if the user is logged in or not and a member of a specific group, do i have to code this or is there some way of doing it in the Manager, I have attempted to use resource groups and such as per the limited documentation on security, but from reading that and a few threads it seems that manager permissions and front end permssion discussions are all jumbled up in the same threads.

I installed the login package, and have a login system that is tested and works.

I have so far suceeded in locking myself out of some pages in the backend although i fixed that through the database.

I created a resource group logged in
I created a user
Created a group registered and added created user
in update group I didnt assign a context.
linked the resource group (loggedin) to the user group.
set a min role of 9999 and set the context to web, also have an access policy - i am not sure what i am supposed to put in here.
Assigned the document to the resource group.
Am i barking up the wrong tree or is this something i should be able to do, any assistance appreciated

You’re definitely heading in the right direction. Make sure that the policy you assign in the Resource group ACL is based on the included Resource policy. Start out with the Resource policy, but after things are working the way you want, duplicate that policy and remove all the permissions you don’t need -- you may just need the load permission if they won’t be editing. Then switch the ACL entry to that policy.

Hi Bob, did you get my PM?

Quote from: goldsky at Jan 21, 2010, 09:19 PM

Hi Bob, did you get my PM?

Yup. Just a few minutes ago. I’ll reply there.

Quote from: BobRay at Jan 21, 2010, 09:15 PM

You’re definitely heading in the right direction. Make sure that the policy you assign in the Resource group ACL is based on the included Resource policy. Start out with the Resource policy, but after things are working the way you want, duplicate that policy and remove all the permissions you don’t need -- you may just need the load permission if they won’t be editing. Then switch the ACL entry to that policy.

Thanks Bob!
still not doing what i thought it would.....
so starting from the top

Create a User
Create a User Group
duplicate resource policy
created a role with 9998
assigned user to role
go into the group access properties and assign document i want controlled to the resource group
Assigned the min role as 9999
Assigned document to resource group

Its just not playing right it wont let me access that restricted doc on the front end even when correctly logged in.

If possible could someone please supply the steps needed for simple control of front end documents through resource groups?
Thank you

EDIT: i dumped out the Session variables. I assume the group membership is held here?
[webUserGroupNames] =>

this entry in the session appears like that with no value.

I too am trying to undestand the permission system of Revo.

Actually it’s a redirect problem.
I have two Resource Group with users assigned to them, let’s say Group1, user1, and Group2 with user2.

Now, if i try to access Resource from Group2 with user1, it send me to my 404 page instead of the error page.

Is that a normal behaviour?

Quote from: lossendae at Jan 22, 2010, 04:40 AM

Now, if i try to access Resource from Group2 with user1, it send me to my 404 page instead of the error page.

Is that a normal behaviour?

Actually that’s exactly as far as I made it too. I’ve setup a User Group with an Resource Group Access to an Access Policy with access_permissions list, load, view.

The protected documents are in the Resource Group that I mentioned and I have a User in the User Group. If trying to [[!Login]] or directly browse to the protected resources I land on the 404 error_page (note: I’ve setup an unauthorized_page for this context).

@lossendae I thought that 404 is the error_page, but it should go to the unauthorized_page

UPDATE1: after reading the whole thread again i think the policies should be list, load, view and not access_permissions

UPDATE2: I try to make a simple "webuser" in a different context. while testing sometimes the context is hidden in the tree, even being logged in as main administrator! I added UserGroup Administrator as superuser to every context. I think this makes sense because the context doesn’t suddenly hide anymore.