I think you’re very close to having it. The secret is that you want to have *no* Resource Group Access ACL entries with a context of ’web’. Having those protects the resources in the front end, which you don’t want. Change those to ’mgr’ (and delete any duplicates) and you should have what you want.
All your Resource Group Access ACL entries should have a context of ’mgr’ -- that will protect them in the Manager, but will have no affect on what’s available in the front end.
The Manager user needs a Context Access ACL entry with a context of ’web’ in order to be able to see the resources in that context in the tree. In all other cases, the ’web’ context refers to the front end, so it should never be used when limiting access in the Manager.
As for which policy templates to duplicate, this section of my Permissions page spells it out (I hope):
- Policies used in Context Access ACL entries should be based on the standard Administrator Policy Template.
- Policies used in Resource Group Access ACL entries should be based on the standard Resource Policy Template.
- Policies used in Element Category Access ACL entries should be based on the standard Element Policy Template.
Of course that assumes that you know what kind of ACL entry you’re going to be creating, but by the time you get around to duplicating policy templates, you should have a sense of that. Here’s the short version of what you’d use when:
- Limiting what member of a user group can do in general in the Manager: Context Access ACL entries.
- Hiding specific resources (in a resource group) from members of a user group or limiting what users in that group can do with them: Resource Group Access ACL entries.
- Hiding specific elements (in a category) from members of a user group or limiting what users in that group can do with them: Element Category Access ACL entries.
BTW, there’s usually no pressing reason to duplicate those templates, since you can grant or deny any of the permissions in the standard policy templates. The only reasons for duplicating one are:
1. You’re tired of wading through the long list of permissions that you’ll never grant to a particular group of users -- You can remove them from your duplicate policy template and never see them again.
2. You want to add some custom permissions to the list. In that case you don’t want to modify the standard policy and need to create a duplicate policy template. Usually, that’s only necessary if you want to use custom permissions to hide individual Top Menu items. In that case, you’d be duplicating the standard Administrator policy template.
☆ A M B ☆
