Template Variable security when editing a Resource

I’ve been searching and trying but I just can’t seem to figure out what I’m doing wrong....

I’m trying to have two ’admin’ logins: siteadmin & sitemanager.
I’ve created:

• Two User Groups: Admin / Manager
• Two Roles: Admini / Manager
• Two Policies: Admin / Manager, where manager has way less rights (if needed I’ll post the rights-list here)
• User Group: Admin --> Resource Group Access: group=Admin, minimum_role=Admin-0, access_policy=Admin, context=mgr
• User Group: Manager --> Resource Group Access: group=Manager, minimum_role=Manager-10, access_policy=Manager, context=mgr

When I set a certain resource only to be editable by Admin, it works like a charm: a Manager user doesn’t see these pages in the doctree.
What just wont work, is when I try to allow access to a template variable to Admin only --> A Manager user is still able to see all the template variables when editing a resource. What am I missing, what am I doing wrong?

I hope someone can point me in the right direction....

The process you used only prevents users from seeing and editing the TV in the Element tree. It doesn’t affect TVs when editing individual documents. To hide them, you need to create a Form Customization rule for each one. You can specify a user group that the rule applies to.

You’ll want a rule like this:



Note that tv2 is *not* the name of the TV. It is ’tv’ followed by the TV’s ID.

gavro, Sorry, I gave you the wrong information. I was thinking of something else entirely.

You *can* hide TVs with Resource Group Access ACL entries and they will be hidden when users edit a resource (I just tested it). The Form Customization rule will also work.

How did you realize hiding TV’s with Resource Group Access ACLs? I just can’t seem to get it done....

edit: with Form Customization is does work... but it’s strange that it’s needed at all; the ACLs should be able to do the job

Hm, just found out that you can do it another way: move certain TV’s to category (e.g. "admin") an then go to:
- Access Controls > Update User Grep: Admin > Element Category Access > Add Category: Cat=Admin / min_role=0 / Access Policy=Admin / context=mgr


Is this the only way, did you do it this way BobRay?

No, I put them in a resource group, which is kind of the old-fashioned way. I don’t know which way (if any) is best.

Here is the resource group method:

To assign a TV to a resource group, right-click on the TV in the “Elements” tree, and select “Edit TV.” Then click on the “Access Permissions” tab to see a list of all the resource groups. Check the checkbox next to each group that you want to assign the TV to.

If a TV is assigned to a resource group, and that resource group is connected with a user group by an ACL entry, only users in that group will be able to see the TV when editing resources.

That’s what I figured; it just will not work this way in my setup. I really don’t understand :/
But anyways, thanks for the help!