Document access permissions ?

High-level, you’ll need to create a new Resource policy without the attributes representing the permissions you want to restrict on a resource.  Try taking away the view attribute from the policy you have attached as an access control list between the Resource Group you want to restrict access to and the User Group of the user you are testing with (in the mgr context for controlling view permission in the manager).  You should not be able to view the object then in the mgr (and the same in the web context if you assigned that access control list to web).  If you want it to disappear from the tree, remove the list attribute.

Ow! That hurt my brain.

But seriously, I’ve been playing with this and can’t seem to be able to create a manager user who can log in to the Manager. I’ve created a role, resource group, policy, etc. and given the user access to the manager context.

When I look at the user grid, my user has a role of "none" but when I click on the Access Permissions tab, the user has the role I assigned to him. I did flush the permissions.

When I try to log in to the manager as that user, I get Error Permission denied [logout]. When I click on logout, I get this: {"success":true,"message":"","total":0,"data":[],"object":[]}. If I then hit the back button, I get the login screen.

It sounds like you’re saying that no one can log into the manager unless they have an authority level of 0.

That seems counterintuitive since it would mean that all users would have the same authority level in the manager.

Can you explain what authority level actually means and how it would be used?

Still wrestling with this. It sounds like the point is to allow users within the same user group to have different capabilities. I’m assuming (perhaps incorrectly) that users have all the rights of users with higher authority numbers and but none of the rights of users with lower numbers.

So users don’t have roles, user groups do, and the authority number determines which of the role’s capabilities the user can access? Am I getting close?

I still wonder if it wouldn’t make sense to allow all users with access to the manager context to log in to the manager. It seems counterintuitive to be able to create a manager user who can’t log in to the manager. My manager user has an authority of 5 (picked out of the air) but can’t log in.

I can see the value of having the hierarchy of authority numbers, but I’m wondering if it’s worth the pain of having to remember exactly what each authority number means in terms of what the user can and can’t do. At first glance, I’d rather just create a different role for each pattern of capabilities rather than messing with authority numbers-- I can’t imagine a scenario where I’d need that many different roles (assuming that any of what I’ve written here makes any sense at all).

If someone could define a common security model or two they think would make a great example or starting point for most situations, I would be glad to configure it and show some screenshots of how I did so and/or build a package from it you could install directly in your Revo installation.

That’s why they are assigned via Roles, so you don’t have to remember what the Authority number means; you can codify it by creating Roles that represent your model logically instead of just numerically.

• When setting "Ressource Group Access" under "manage user groups and roles" -> "update a user group", if you do not fill in Access Policy and Context, the form validates ok, but then you can’t update this user group anymore : when you try to update the user group, the form is blank, as if creating a new group.
• Under "Access Permissions" , in "User Group Access to Ressource Groups" if you create a rule with user group set to "anonymous", the rule doesn’t appear in the list
• It seems you can’t edit any rule in "User Group Access to Ressource Groups" : the window opening only has a Save and a Cancel button, and no fields

• First, if you don’t remplace "$this->" by "$modx->" in the following line of the snippet, you get an error.

/* check if inside manager */
if (!is_object($this->context) || ($this->context->get('key') === 'mgr')) {
    return ''; /* don't go any further when inside manager */
}

• Secondly and most important, I think, MemberCheck never returns anything (it does not detects if you are member of any group). I traced the problem until function isMemberOfWebGroup (in modx.class.php, line 1331) :

if ($groupMemberships= $user->getMany('modWebGroupMember'))