How to Create Users with Access to Manager but not SuperUser

I’m having trouble with Alpha 6 in setting up Manager users who can only create/edit/delete resources within a particular context.

I have set up the Resource Group, the User Group and Assigned resources to the Resource Group. I created a new role called "site admin" w/ authority 0. I created a duplicate mgr Resource Group w/ Access Policy only to Resources (not Contexts) and assigned that to the new User Group as well...

What am I missing? When I log in as the user I get access denied.

Did I do too much, not enough or the wrong stuff?

I may be wrong, but I think that the user management is still under development at this time and only superusers are available...but I could be mistaken

Quote from: dev_cw at Feb 26, 2009, 06:37 PM

I may be wrong, but I think that the user management is still under development at this time and only superusers are available...but I could be mistaken

You are mistaken sir. But to be fair, there is currently no documentation describing the new security model and it is vastly different than before.

Quote from: foniksonik at Feb 26, 2009, 06:30 PM

I’m having trouble with Alpha 6 in setting up Manager users who can only create/edit/delete resources within a particular context.

I have set up the Resource Group, the User Group and Assigned resources to the Resource Group. I created a new role called "site admin" w/ authority 0. I created a duplicate mgr Resource Group w/ Access Policy only to Resources (not Contexts) and assigned that to the new User Group as well...

What am I missing? When I log in as the user I get access denied.

Did I do too much, not enough or the wrong stuff?

Resource policies are for accessing particular Resources from a specific Context. If you attach a policy to a Resource Group, then every user who accesses those Resources in the specified Context, be it in a front-end Context or the mgr Context, will need the Policy Attributes representing the permissions you want them to have on those Resources (i.e. load, view, save, etc.). Those without the required Resource policy attributes (i.e. not a member of one of the User Groups given access to the Resource Group in the Context with a specific Policy) will be denied.

But you will have to give them access to the mgr Context before they can access ANY Resources within in it (or do anything in the mgr for that matter). Attaching Context policies to specific front-end contexts would likewise give them permissions to perform the activities defined by the policy attributes from that context, just as it would from the mgr context.

Also, just FYI, the higher the Authority you give to a Role, the less authority you have, i.e. 0 is "super user" and 9999 is a standard "member"

Quote from: OpenGeek at Feb 26, 2009, 08:10 PM

Resource policies are for accessing particular Resources from a specific Context. If you attach a policy to a Resource Group, then every user who accesses those Resources in the specified Context, be it in a front-end Context or the mgr Context, will need the Policy Attributes representing the permissions you want them to have on those Resources (i.e. load, view, save, etc.). Those without the required Resource policy attributes (i.e. not a member of one of the User Groups given access to the Resource Group in the Context with a specific Policy) will be denied.

But you will have to give them access to the mgr Context before they can access ANY Resources within in it (or do anything in the mgr for that matter). Attaching Context policies to specific front-end contexts would likewise give them permissions to perform the activities defined by the policy attributes from that context, just as it would from the mgr context.

I promise i mean this in truth. I think i need someone to explain with a diagram or simpler example. (i expect its coming) just not getting it.

So any wiki article, or jpgs, diagrams to explain how this works?

Quote from: OpenGeek at Feb 26, 2009, 08:10 PM

You are mistaken sir. But to be fair, there is currently no documentation describing the new security model and it is vastly different than before.

Sometimes I love being wrong (which is a good thing considering the ratio of times I am wrong). Thanks for setting me straight (I should refrain from answering Qs on Revo since I am way out of date..need to catch up).

Quote from: ChuckTrukk at Feb 27, 2009, 12:43 AM

I promise i mean this in truth. I think i need someone to explain with a diagram or simpler example. (i expect its coming) just not getting it.

So any wiki article, or jpgs, diagrams to explain how this works?

Not yet; once we get the new MODx site pushed out, I’ll see if I can’t at least post a good example showing a scenario like this being setup in the new manager.