One user with different resource permissions for different contexts

Hi All.

We are building a multi-language website and have run into problems getting the security permissions correctly set up.

Basically we want our local editors from each contry/language to only see their own context and the English context e.g. a German editor can only see the german context and the english context. They should not be able to see each others’ contexts. This is working fine, however...

The problem is that an editor should have full editing permissions for the resources in his/her own context, but only be able to view and duplicate from the english context (in the Manager). So we need to set context specific permissions in the manager for the editor.

Can this be done - we’ve been trying for two days now and are stuck!

It seems the only thing affecting resource editing permissions in the Manager is changing the access policy for the Mgr context - permissions set for Resouce groups doesn’t seem to change anything!

Any help is very much welcome - thank you in advance
Crealive

I haven’t tried this for real, but this should work:

Copy the ContentEditor Access Policy. Call it LanguageContentEditor.

Create Usergroups for each Language you want to use, eg ItalianEditors, GermanEditors, EnglishEditors and a bucket account for accessing the English context - AllEditors. Add users as Members to a language-based usergroup and the AllEditors usergroup as required.

Each Language usergroup should have Context access as Member with policy ContentEditor for the context they have a right to (eg ’Italy’).

AllEditors should also be given Context access to the English content, with policy LanguageContentEditor and role Member.

You should now have German editor with access to both English and German context, but not Italy. You can then shave off permissions that GermanEditor doesn’t need in the English context from the LanguageContentEditor access policy (for example, I’m not sure if removing ’Edit’ will stop them being able to duplicate content, but you probably don’t want them being able to edit).

Note: you might need to remove the English editor user(s) from AllEditors if it is restricting them (I can’t remember if permissions are added or subtracted).

Thanks odeclas.

We tried creating UserGroups for EnglishEditors, GermanEditors and FranceEditors - and one for everyone AllEditors. Added local users to the language UserGroups and also added all users to the AllEditors.

Added Context access for each UserGroup - e.g. GermanEditors have member access to German Context with ContentEditor permissions policy. Also AllEditors have member access to the English Context with LanguageContextEditor permissions policy (but this one is much more limited - no editing of resources).

Now Germans can see the German Context and the English Context - but not the French Context. This is all great.

Now, in order for any user to log into the MODx Manager we had to add the Mgr Context as well to the AllEditors UserGroup with the languageContentEditor policy (the restricted one) - however the policy added to Mgr completely overwrites any access policies set for the German and French Context. So whatever a user can do in the Manager (view resources, right click menu etc.) is determined strictly by what policy is added to the Mgr Context.

Are we doing something wrong here? We need to add the Mgr Context to access the Manager, but it seems the policy set for the Mgr Context overwrites policies set for any other Context. We need the German user to log in - See the German and the English Contexts (this works) - be able to have full permissions for German resources, but only have limited permissions for the English resources (this is not working). - so he can e.g. edit, create new etc within the German context and only view and duplicate within the English Context.

Any ideas are very much appreciated - thanks in advance

Quote from: Crealive at Mar 25, 2011, 08:12 AM

Now Germans can see the German Context and the English Context - but not the French Context. This is all great.

Now, in order for any user to log into the MODx Manager we had to add the Mgr Context as well to the AllEditors UserGroup with the languageContentEditor policy (the restricted one) - however the policy added to Mgr completely overwrites any access policies set for the German and French Context. So whatever a user can do in the Manager (view resources, right click menu etc.) is determined strictly by what policy is added to the Mgr Context.

I think you can work around this by creating a new ’default’ context ’English’ - instead of using the actual default ’web’. You can give everyone ContentEditor access policy for Mgr and their own context, then language editor usergroups get reduced rights in context ’English’ (ie the LanguageContextEditor access policy) and no context access to the other language contexts.

There may also be a way to do this with role levels, but I haven’t used them at all yet.

Thanks - we just tried it, and no matter what we do it is the policy added to the Mgr Context that determines what can be done to the resources within the different language specific Contexts.

If we do the following :
GermanEditors and AllEditors both have GermanMember added as user.

User Group : GermanEditors
- Add German Context with ContentEditor policy (all allowed)

User Group : AllEditors
- Add English Context with languageContentEditor policy (most is restricted)

The result when GermanMember logs in:
- Gets "Access Denied"

Then we add the Mgr Context to UserGroup GermanEditors with the ContentEditor policy
- User can log in, see German Context and English Context
- PROBLEM! User has ContentEditor policy access to the English resources though he should only have languageContentEditor policy access as specified for the English Context and the UserGroup AllEditors!

It must be possible to have different permissions for different resources in the Manager tree! - but how?

The only thing that has any impact on resource access permissions is whatever policy is set for the Mgr Context.

Thanks

The permissions for taking generic actions in the manager is what the Context Administration Policies define. These only control access to Contexts and what actions a user can take from those Contexts. To manage permissions on different sets of Resources, you will need to use Resource Group policies attached to the specific Contexts they are in.

Jason, throw us a bone here.

There are four access policies listed for Resource Groups

Load
Load, list and view
Object
Resource

These are not documented on RTFM, so to follow the OP’s issue through, and grant someone permission to view and duplicate a resource but not edit it, we’re talking ’Object’ access policy are we?

And for the ’normal’ editors, they would need ’Resource’ access policy?

And, seeing as we now need to create resource groups, we will need to give Anonymous user, PLUS any editors, ’Load’ access in the various front-end contexts?

I’m looking for where I buried the bone odeclas...

But seriously, I will address this in a detailed reply, and in the documentation ASAP. Just finishing up the first 2.1 Release Candidate now...

thanks guys.

We are still struggling a bit with this. By adding all the English resources to a Resource Group and setting a strict policy for this we almost got the result we wanted.

Now the German editor can edit his own resources freely in the German Context and only (as intended) duplicate the resources in the English Context. Problem is now that when an english resource is duplicated it is automatically added to the same Resource Group as its original. Therefore our German editor can’t just drag the duplicate resource over to the German Context and start editing it - he also needs to remove it from the Resource Group (which is a bit too technical for him).

We also noted that the rightclick menu in the tree does not always reflect the users editing capabilities. If you are not allowed to edit or view a resource you still get these options in the rightclick menu. Only once you click on a menu item you get a page saying "access denied". Would be better to not show the rightclick option in the first place and have a cleaner rightclick menu.

Thanks in advance

I’m not sure there is a way around that. You might be able to use a plugin to set the resource group of the document based on the user group of the current user -- tied to OnDocFormSave.

An OnBeforeDuplicateResource event would come in handy here, but I don’t think there is one.