Minimum permissions to log in to the Manager

I have a user that can no longer log in.

The user has the following permissions:

load
list
resource_tree
database
actions
add_children

What’s missing?

Quote from: BobRay at Feb 15, 2010, 11:34 PM

I have a user that can no longer log in.

The user has the following permissions:

load
list
resource_tree
database
actions
add_children

What’s missing?

• login
• frames

FYI, add_children is only applicable to Resource Group ACL Policies...

Should ’frames’ be removed?

Frames is necessary, but login is not. In fact there’s no login permission in either of the two (unedited) standard policies I have and the admin can log in. There’s a logout permission (though I can’t think of a situation where you wouldn’t want to let someone log out -- and users can log out without that permission). I’m thinking that the frames requirement is new because I’m pretty sure the user could log in before I updated the install.

After adding frames permission, the user can log in and can see the resource tree and an abbreviated Top Menu, but without the "home" permission, the home panel on the is blank with an
"Error!"
"Permission Denied" message.

What if you don’t want the user to see the information on the Home page and you don’t want to display an Error message?

BTW, the Recent Documents section of the home page seems to be showing the low-level user all of the admin’s documents, even though the admin is logged off.

Let me know if you want anything filed in Jira on these.

frames is legacy, from Evolution. It has always been in there though, since I added the new security model anyway. As to whether it should be removed, I do not know, but I think it is the main permission needed to access the mgr UI.

Quote from: BobRay at Feb 16, 2010, 09:21 PM

What if you don’t want the user to see the information on the Home page and you don’t want to display an Error message?

Good question. Any ideas?

Quote from: BobRay at Feb 16, 2010, 09:21 PM

BTW, the Recent Documents section of the home page seems to be showing the low-level user all of the admin’s documents, even though the admin is logged off.

Does the low-level user have load permission on these Resources?

Quote from: OpenGeek at Feb 16, 2010, 11:55 PM

Quote from: BobRay at Feb 16, 2010, 09:21 PM

What if you don’t want the user to see the information on the Home page and you don’t want to display an Error message?

Good question. Any ideas?

Separate permissions for each section (ugh!). Form Customization settings (I don’t really like this one either). Isn’t it possible to have a custom "home" panel? Maybe that’s a solution, though I’m not sure it can be done on a per-user basis.

Also, maybe we could just show something simple there like the site name in big type (or a default chunk -- I really like this idea) if the user doesn’t have "home" permission rather than the error message. The default home panel is pretty daunting for naive users and distracts from the stuff they’ll actually be doing. It would be nice to have an simple but attractive alternative for them without having to create a custom page.

Quote from: BobRay at Feb 16, 2010, 09:21 PM

BTW, the Recent Documents section of the home page seems to be showing the low-level user all of the admin’s documents, even though the admin is logged off.

Does the low-level user have load permission on these Resources?

I think so, but the message there says: "This list shows the last resources you created or edited:" and, in many cases, you might not want the user to see everything the admin or other users have been doing. My preference would be to have the display match the message.

I would add ’view’ to this list, if they want to be able to view any Resources.

Quote from: splittingred at Feb 17, 2010, 08:19 AM

I would add ’view’ to this list, if they want to be able to view any Resources.

We’re talking about Context ACL permissions, not Resource Group ACL permissions; view does not affect the ability to view Resources in a Context (or to view a Context for that matter).