Roles and UserGroups

I am developing a website with several editorial sections.
Let’s say I have three sections: Entertainment, Technology, News

In each section I will have an Editor, a Reviewer, a Writer and a Photographer (or media person).
But each section will have its own team, so there are going to be 3 Editors, 3 Reviewers, etc.

So I go ahead and create the UserGroups, one for each section. Easy!

Now I want to create the Roles, but I can only create one Editor and
this Role will be used in Access Control.

How do I do this?

The only way I am thinking of doing it is to have a lot of Roles:
enterEditor, techEditor, newsEditor
enterReviewer, techReviewer, newsReviewer
etc. etc.

Is this the only way to do this? so each Editor has specific permission to its section?
TIA

charliez,

Roles in Revo are confusing for former Evo users.

In Evo, your role contains your permissions. In Revo, a role is really just an authority number and contains no permissions. The permissions are in policies.

How you set up your system depends on the difference between the different kinds of editors you have.

If their permissions are hierarchical (that is, each editor has access to all docs and Mgr commands that lower-level editors do), then you can do it with multiple editor roles in Context and Resource Group Access ACL entries for one Editors user group, since users automatically get stuff from other uses in their user group with higher authority numbers (roles with higher authority numbers).

If all you want to do is control their access to resources (and they will all have the same mgr capabilities), you then need to ask if the access to resources is hierarchical -- if so you can do it with roles and Resource Groups Access ACL entries. Otherwise, you’ll need a usergroup for each of them and separate resource groups for the resources -- but they could possibly all have the role of Editor (depending on their Manager capabilities).

If, their permissions in the Manager are not hierarchical and users will have overlapping or different Manager permissions, then you will need a different policy for each of them and a different Context Access ACL for the mgr context for each group.

So, what I’m saying is that depending on your setup, you might need one role with different user groups, resource groups and/or different policies -- or you might need many roles and a smaller number of groups.

One way to approach it is to make a some kind of chart detailing, for each group, which resources they can access, what they can do with the resources, and what Manager actions they can perform. Then try to figure out how to make that happen with the fewest user groups and the fewest resource groups. The roles, policies, and ACL entries should follow from that. There are probably some excellent tools out there to help you resolve this, but I’ve never used any of them. Most of my sites have 1-3 users.

I hope this hasn’t confused you further.

Let me try to explain it another way, because the section above looks pretty confusing to me (and I wrote it).

1. The first line of control for what resources users can see at all in the Manager is linking user groups to resource groups in Resource Group Access ACL entries (with a context of mgr) -- just like in Evo. It’s the equivalent of linking doc groups to manager user groups in Evo.

2. Control of what users in a user group can do in general in the Manager (e.g., change permissions, edit resources, create snippets, etc.) is controlled by the policy they get assigned in a mgr Context Access ACL entry. That policy should be a subset of the Administrator policy.

3. Control of what users in a user group can to *with the resources in a resource group* is controlled by the policy assigned in for that resource group in a Resource Group Access ACL entry created in #1. That policy should be a subset of the Resource policy.

4. Users in a user group inherit the permissions of users *in that group* that have roles with higher authority numbers. That’s the only function of roles in Revo.

Bob,

Thanks a lot for the great response. And before I forget, thanks a lot for
both Permissions Guides, for Evo and for Revo, they help us a lot!!

I guess that after reading the MODx Security Docs, Shaun’s screencast and your
Guide, I was left with the notion of creating Departments for UserGroups and
that is why I was thinking that, plus that was the way Evo worked too.

Your four points at the bottom of the response are very clear... and it is
starting to sink in...

1. I will use UserGroups to keep together each function, i.e. all the Editors
and manage their permissions with ACLs.

2. Great to have a way to emulate the way Evo Permissions works, your #1 point.

3. We do not have to use everything in our arsenal on each website, it depends
what needs to be protected and from whom, or what functionality we need to implement
like private pages or member only sections that will work wonderful with ACLs and
user profiles.

4. There can be users without a role and user without a user group.

Thanks again BOb, great stuff...

Thanks for the very kind words. I’m glad it helped.

I put that last section (the 4 points) up at Bob’s Guides on the Revolution Permissions page.