Users

OK playing around with security and users on revo latest svn, and really struggeling. I know the docs are being written on this when people have the time. But some guidlines would be helpfull, since at the moment when I add new users and groups they are not even allowed to login to the manager.

What I am attempting to do to is have 2 sites, both using the same DB and manager and even some of the same templates.

What I want to do is have the following groups with the users in some or multiple groups as bellow

Group - Site 1 managers
Role - Allowed to edit the whole of site 1
Users - 1,2,3

Group - Site 2 mangers
Role - Allowed to edit the whole of site 2
Users - 3,4,5

Group - Site 2 editor
Role - edit news pages only
Users - 6


Any help in how to set up my users and groups with in revo would be great and what settings I need to set within each user group and context and pages.

Anyone got any pointers on the use of user/resource groups etc... that can help me solve the above.

Even just getting additional users logged into manager, with out adding them to the admin group.

I’m struggling with this too, so take my advice with a large grain of salt.

I did get users who could log in to the Manager by putting them in a user group, then giving that user group:

1. Access to the Mgr context with a role of super-user and a policy of administrator (this will let them log in, but not see any resources)

2. Access to the Web context with a role of super-user and a policy of administrator (this will let them see resources in the tree)

Once that’s working, you can play with alternate roles and policies.

You can, for example, duplicate the Administrator policy and remove the things you don’t want those users to be able to do, then assign that policy to the user group instead or Administrator.

You can also create a lesser role.

Remember, too, that you can use Form Customization (on the Security menu) to hide tabs and fields that you don’t want members of certain user groups to see.

Hope this helps.

Quote from: BobRay at Dec 09, 2009, 03:50 PM

Remember, too, that you can use Form Customization (on the Security menu) to hide tabs and fields that you don’t want members of certain user groups to see.

Thanks Bob I’ll play with it tommorow, and form customiztion is the next thing to play with

Quote from: peteedley at Dec 09, 2009, 04:02 PM

Quote from: BobRay at Dec 09, 2009, 03:50 PM

Remember, too, that you can use Form Customization (on the Security menu) to hide tabs and fields that you don’t want members of certain user groups to see.

Thanks Bob I’ll play with it tommorow, and form customiztion is the next thing to play with

FC is ridiculously easy compared to ACL security stuff, but to make full use of it, you need user groups, so it’s necessary to get those working first.

OK for anyone else interested this is what I have done so far.

1) Goto security -> Access Controls
2) Click the access policy tab
3) Duplicate the Administrator policy
4) Edit the duplicate policy and rename
5) Save

6) Goto security -> Access Controls
7) Click the user group tab
8) Create a new user group
9) Give it a name
10) under the conexts box (part way down the screen) add new with these setting
1) Context = mgr
2) Minimum role = super user
3) Access Policy = policy name you chose earlier
11) Duplicate 10 for each context you want that group to edit.

12) Click security->manage users
13) Click new user
14) Fill in details needed
15) Click access Permissions tab
16) Click Add user group to user with the following settings
1)User group = the group you want the user to belong too
2)role = Super user


This should now allow your users to log on and see and edit the contexts you want them to and not others
Duplicate this for a second group to edit other contexts.

I will now play with resource groups and find a way to only allow users to access certain resources within a given context.

I could definitely be wrong about this, but it may be that by making all the users super users, they will automatically inherit the default administrator policy as well (since they have an authority level of 0). That would mean they won’t be restricted to the capabilities you limited them to when you duplicated and edited the administrator policy.

You might want to check that before messing with resource groups.

I had the same thoughts, didn’t have time to test that after setting it up. I will post my findings on here.

EDIT / UPDATE

OK I left my user as superuser, but in the Access Policy I removed the option to view snippets. When I logged in as that user I could not view the snippets, infact they had disapeared off the elements tree, which is perfect just what i hoped.

I think that the user role does not over ride anything in it’s self it is just a way of linking a user to a given access policy or policys. with in a user group.

OK I’m sure I’ve got the user section sorted I can hide things like snippets from a given user group. I am now looking at trying to find a way to hide the entire Elements tab from a given group, I have looked through the Access Policy to see if there is something there to do it and can’t find anything so I’m assuming that form customization is the way to go for this.

I have looked at this and feel that there should be a way to hide the tab using the tabVisable rule.

But I can’t get my head round 2 things and can’t find much in the documentation on it.

• But what action would I apply this to - or as i think I would need to apply it to many actions so as to hide it in every possible screen.
• Which field and containing panel do I apply it to, is there a list of these anywhere.

Bob could you give me some pointers on this if not I’ll start a new thread on this issue.

I know how to hide a tab on the right side (e.g. the TV tab in Create/Edit Resource), but I don’t know what the appropriate action, the containing panel, or what the tab name is for the elements tab.

I was able, using acces policies, to make the elements tab show no elements.

Have you found a way to restrict what resources show in the tree? Using Resource Groups and User Groups, I can’t seem to restrict users to any subset of the resources.

As for starting a new thread, I think there are only two people who know the answers to these questions and I’m afraid they’ve been too busy to answer them.