need direction in setting up a solid access control scheme

This is what I need to do:

In my web context, I want to create multiple top-level resources, each representing the "ultimate parent" resource for a given department of my organization. Let’s use ’HR’ and ’Finance’ as example departments.

I then need to create an ’HR’ group that can A) create new resources under the top ’HR’ page, edit & delete existing ones, and pretty much do anything and everything with ’HR’ resources, and B) see the pages of ’Finance’ and other departments in the tree, so that they can link to them in their documents. And so on, for each department.

I think that sums it up.

So my questions (the ones I’m aware of) are.

1. What access to the mgr context does the HR group need in order to even use the manager interface?
2. What access to the web context does the HR group need in order to view (but not edit) all of the resources in the context?
3. What is the best way to grant the HR group full rights to everything under the HR parent resource?

Quote from: jrotering at Feb 25, 2010, 04:15 PM

1. What access to the mgr context does the HR group need in order to even use the manager interface?

The HR group will need a policy attached to mgr in the Context ACLs with load, frames, new_document, edit_document, save_document and whatever other Context permissions you want to give them. The group will also need a Context ACL policy attached to web with at least the load permission; this is because they need to have permission to "load" the web Context itself when editing Resources from that Context in the manager.

Quote from: jrotering at Feb 25, 2010, 04:15 PM

2. What access to the web context does the HR group need in order to view (but not edit) all of the resources in the context?

Unless you are protecting Resources with specific Resource Groups in the web Context (i.e. to prevent access by anonymous users by granting specific access to a Resource Group), they will not need any Resource Group ACLs attached to the web Context.

Quote from: jrotering at Feb 25, 2010, 04:15 PM

3. What is the best way to grant the HR group full rights to everything under the HR parent resource?

Put the HR Resources in an HR Resource Group and create a Resource Group ACL for the HR User Group, attached to the mgr Context (because you want to limit access to edit in the manager). You can assign them the default Resource Policy permissions to give them full rights to the Resources in the HR Resource Group.

Now, in order for the HR Group members to...
Quote from: jrotering at Feb 25, 2010, 04:15 PM

see the pages of ’Finance’ and other departments in the tree, so that they can link to them in their documents

you would need to put the Resources for each department into a common Resource Group as well (say Departmental Resources or something), and then attach this Resource Group to a Policy with the load, list and view permissions to all of the departmental User Groups, again in the mgr Context. The load permission allowing them to load the data for those Resources in the manager, list allowing them to be listed in the Resource tree in the manager, and view allowing the users to see the Resource View in the manager.

FWIW, I highly recommend reading BobRay’s information on Revolution Access Permissions until we have additional official documentation available on the subject.

I would like to also have these groups NOT be able to load, view, or anything in the manager except for their content. I am trying to refrain from using contexts for my groups, but I have yet to keep these users from being able to access the "normal" web content in the manager.

I know... I know... they will inherit the other "lower authority" / "higher numbers" -- I would just like to lock them into ONLY their group...

I have been setting up ACL’s for years in Domain Controllers... Revolution ACLs are about one step short of those.

I am currently re writing Bob’s tutorial -- in hopes of streamlining it and making it a little more simple. If successful I will get it to him.