Can't add Resource access policy in Context Access

Disclaimer: I am not a security admin guru so pardon my middling understanding of access control in MODx

Environment: MODx Revolution 2.0.8, upgrade a few months ago from 2.0.7
Web Site: www.netuitive.com

Problem:
- Some of my limited use user groups tell me they can create resources (e.g. job listing in Company/Careers), but cannot publish
- If I login as an Admin, I can publish fine
- I think I traced the problem to Context Access Management in Access Control for User Groups
- Whereas I have mgr and web context access in the Admin role using a Resource Policy (which allows publish, unpublish), this policy seems to be missing in the other user groups
- However when I try to ADD this policy in the other user groups, the Resource Policy does not appear in the pull down menu (I only get Administrator, Content Editor, Load Only, Load/List and View, etc.).
- So I think this is preventing this user group from publishing
- What is weird is they remember being able to publish before; perhaps the upgrade to 2.0.8 is actually ENFORCING security correctly now?
- Even so, why can't I add a Resource Policy to this group in the Context Access tab to fix the problem?

Any ideas?

The Resource Policy isn't appropriate for a Context Access ACL entry. That's why it's not shown.

There is a 'publish_document' permission in the Administrator policy and a 'publish' permission in the Resource policy. The first one is necessary to publish any document. The second is necessary to publish a doc in a protected Resource Group.


------------------------------------------------------------------------------------------
PLEASE, PLEASE specify the version of MODX you are using.
MODX info for everyone: http://bobsguides.com/modx.html

Thanks Bob. Can you clarify what you mean by "protected Resource Group"? Because I have set up Resources Groups and assigned them by User Groups with the intent of, for example, only letting my Blog and News Poster edit that group of resources, and my HR user only the Company/Careers page resources. That's why I thought I should be able to use a Resource policy to manage publication rights.

Are you suggesting I give the HR and News/Blog users Administration Policy rights just to get the Publish Capability? There's a bunch of other permissions in that policy like create template, create snippet etc. But I guess if they don't have access to those resource sections that should be OK?

By the way Bob, I just added that Admin Policy Rights to my HR and New/Blog Super Users and I *think* that did the trick. They seem to be able to publish now. And I am assuming the Resource Group Assignments protect me from what else they can edit?

Hmm....fixed my Publish Problem, but not these users suddenly have access to things like Security. Can you clarify how I can manage resource access by group and allow users in these groups to create and publish child pages to these resources without me having to give them Administrator Policy rights?

Resources are protected by putting them in a Resource Group and connecting that Resource Group to a User Group. That protects the Resources from users outside the group. When you make that connection, you use the Resource Policy (or a custom Policy based on the Resource Policy Template if you don't want them to have all the permissions in that Policy). That's where they would need the 'publish' permission.

Your next step is to create a custom Policy based on the Administrator Policy Template, but with key permissions (e.g. security) unchecked. You might be able to use the ContentEditor Policy for this, but I can't remember if it has the publish_document permission checked or not. Then use *that* Policy in your 'mgr' Context Access ACL entry for those users. You definitely don't want them to be able to lock you out or change your username and password!

I would definitely recommend *not* putting the users in the Administrator Group because that will limit your ability to use Form Customization rules for them in the future.

Note that they will have access to all Resources unless you protect them by adding the other resources to a Resource Group and connecting that Resource Group to the Administrator User Group with a Resource Group Access ACL entry (and they're not members of that group). It sounds like you've already done that, but I mention it for others.


------------------------------------------------------------------------------------------
PLEASE, PLEASE specify the version of MODX you are using.
MODX info for everyone: http://bobsguides.com/modx.html

Bob, I did #2 just as you suggested and it seems to work using a limited Admin policy which I cloned and called "publish". I am using Resource Groups and User Groups, which is why I don't understand why I don't get Resource Policy in the pull down. Oddly, I DO have Resource Policy set up in my old Admin user and resource groups.

So I seem to have a workaround but I am wondering if there is a bug that prevents me from using the Resource Policy with User Groups to allow publishing.

In any case, seems like I am following your recommendations the best I can. Using my own created "Publisher" policy I am able to hide all the really dangerous capabilities of the Administrator policy.

So thanks for your help. Do you think MODx 2.0.8 might have some kind of bug preventing me from using the Resource Policy as designed?

Thanks again!

Maybe I'm misunderstanding you. The Resource Policy should show up when you create a *Resource Group* Access ACL entry. Are you saying that it's not there?

It will never show up when creating a *Context Access* ACL entry, though it did in some earlier versions of Revolution. You may have selected it in an older version.


------------------------------------------------------------------------------------------
PLEASE, PLEASE specify the version of MODX you are using.
MODX info for everyone: http://bobsguides.com/modx.html

I have 3 Resources groups - 1) Admin 2) All Content 3) Blog / News
I have 3 User groups - 1) Admin 2) Editor 4) Author

When I administer Access using User Groups, the Admin group pretty much has access to all groups.
The Editors have access to "all content", and the Authors have access to Blog / News. Editors and Authors used to be able to publish - now they can create, even delete, but can't publish.

Note this was set up by a contractor over 2 years ago on 2.0.7 (I am now on 2.0.8).

I go to Update User Group (e.g for Editors) and only saw web / mgr Context Access Policies for Content Editor and QuipModerator. Content Editor seems to allow create / delete document. No publish unpublish. I figure that's my problem and maybe 2.0.7 did not enforce that or the default policies changed.

So I look at the Admin User Group and it had web / mgr Context Access Policies for Administrator, QuipModerator, Editor, and Resource. When you expand these to see what's allowed, the only ones with publish / unpublish rights were the Administrator and Resource Policies. That's why my first attempt at resolution was to try to add the Resource Policy to the other groups. But when I go to try to do that, Resource is not a policy I can add to the Context Access policies for either the Editor or Author groups. Simply does not show up no the pull downs.

That's why I had to resource to creating a special "Publisher" policy which is a stripped down administrator with publish / unpublish rights (as you were suggesting). And that seems to now give my Authors and Editors publishing capabilities.

Long winded but I hope this makes sense. I have attached the screen shots of the context access policies for the Administrator and Editor groups to show what I mean (the Publisher policy is m custom one based on stripped down Administrator)

By the way, since i have a small user group, and I don't need fine grained control, they are all "Super Users". What they can do is managed by the Resource Groups, Use Groups, and User Group context access policies.