Help: Security Setup

Yep, I'm here again. I said I would.

This is a MODX 2.2. project.

I'd appreciate some pointers into the right direction with the following setup.

Essentially, I have to create a site with only on public page, the rest is password protected for users only. The user can be split into the following groups

Department 1
- Role 1
- Role 2
- Role 3

Department 2
- Role 1
- Role 2
- Role 3

Each department actually exists in differing locations (say Berlin, Paris, London) - which I added as an extended field. I think, this part is not the problem, as it only affects the data pulled from the DB and not which resources the use can access.

Then I have the following resources

- Home (resource) --> can accessed by everybody, it contains the login fields

- Dashboard (resource) --> Can be accessed by all users that are logged in, but it will/should display different information based on Department and Role.

- Tasklist (container)
--- Task 1 (resource) --> Department 1 only
--- Task 2 (resource) --> Department 2 only
--- Task 3 (resource) --> Department 1 only

- Notifications (container)
--- Notifications 1 (resource) --> Department 1 only
--- Notifications 2 (resource) --> Department 2 only
--- Notifications 3 (resource) --> Department 1 only

The tasks are foremost based on the department the user is in. But within the tasks themselves, they might have certain rights (edit fields, etc.) based on their role.

So, my approach would be this:

1. Two User Groups: Department 1 and Department 2 (define Resource Group Access accordingly)
2. Three Roles: Role 1, Role 2 and Role 3 (is essentially the Member roles, as they have viewing rights only)
3. Two Resource Groups: Department 1 and Department 2 (these will be containing the pages that can be separated based on department access)

Is this the right way to go at it? What about the dashboard - would you have two dashboards one for each User Group?

Let me know what you think please...

a.

This might be a use for Contexts, with a context for each department.

elgrandeadi - I would do what you described. On one of the sites I manage, that's what we have been doing for allowing access to view things.