-
MODX Staff
- 2,502 Posts
In order to make it easier for people to learn and understand how access policies, users, groups, roles and etc. all works in Revolution we first want to find out how you most often implement access policies on your projects be it with Evolution or even another CMS.
We are not looking for the how so much as what you want give or restrict users’ access. Here is my example:
I have a Jobs section on a site. I want to grant access to my HR personnel so that they can add and update the job listings on the site and nothing else.
What rules in MODx Revolution Security will I have to implement in order to make this work?
Please share your common implementation cases. They can be more complex than this example but we are not aiming to walk you through a specific implementation.
Author of zero books. Formerly of many strange things. Pairs well with meats. Conversations are magical experiences. He's dangerous around code but a markup
magician.
Blog ✦
Twitter ✦
LinkedIn ✦
GitHub
-
☆ A M B ☆
- 427 Posts
1) I would want to change the manager so that when a given user logs in, he/she only sees what I want in the manner I want.
- Full write /delete: allow a department to add their own content / snippets / chunks -- without having access to any others.
- Read only: instructional back end content, selectable inserts to drop into pages that have already been built somewhere else.
- Write only: thinking something like an input form for a snippet or option setting for the read only like a zip code for a weather retrieve from google.
2) I would also like to be able to block the files menu, backups, or anything else from being able to access content I do not want them to. In essence, the user should be able to backup their own content, but not get access to modx internals or plugins, snippets, chunks, TVs I have constructed. Think HIPAA compliance.
These are just a couple off the top of my head.
I’d like to see an example where there are 25 users, each of whom can edit his or her own personal page and create/edit children of that page but can’t see or edit any other resources, snippets, plugins, or files.
Here’s another semi-real-world example:
I’ve got a site with four users (the fifth one below is hypothetical):
1. admin - that’s me, can do anything.
2. News editor - can create news stories under the "News" container, and can delete, publish, and edit them as well as setting publish and unpublish dates. Can’t create or use TVs. Can also edit all the existing pages in the root and can create new pages in the root, but can’t publish them or change the pub status of the original site pages.
3. Photo editor, can upload photos via MaxiGallery and can create new galleries -- all under the /photogalleries subdirectory. Can’t do anything else. Can’t see, create, or edit resources or elements.
4. Newsletter editor, can upload .pdf newsletters using the fileupload snippet. Can’t do anything else (like photo editor).
5. Snippet developer -- develops snippets on request at home on localhost. Can do nothing but create new snippets and edit existing snippets on the site. Can’t see or alter resources or other elements.
Quote from: splittingred at Dec 18, 2009, 09:11 PM
Quote from: BobRay at Dec 18, 2009, 08:54 PM
I’d like to see an example where there are 25 users, each of whom can edit his or her own personal page and create/edit children of that page but can’t see or edit any other resources, snippets, plugins, or files.
I can tell you right now this wont be possible until 2.0.1 or later when we implement user-specific ACLs, unless you create 25 user groups. 
I know.
It’s not a far-fetched scenario, though, and I was kind of raising the issue of how many steps it would take if you have to create a custom policy, figure out the authority level, then create ACLs for all 25 user groups and put the admin in all of them as well.
OK heres what I’m after.
2 or 3 contexts representing different sites or sub domains
Super Admin
Can Access and do everything on all contexts
Site Admin
Can Access and edit all resources except snippets/templates (any) and chucks (within a specific catagory), on a specific context
News editors
Can Access 1 or more context but only the News Directory, everything else hidden including most menus and tabs on the left.
