Login and permissions

I am having a dreadful time with what should be a very simple task of protecting a bunch of pages on the front-end.

Login is installed and implemented in a login page, which is working fine.

I have created a resource group and a user group (had the resource group wizard create the user group), and set up the web context with load access policy for the user group. I've also tried load, list, view for the access policy. I've set the login page as the unauthorized page, it is published and unprotected.

When attempting to access a page assigned to the resource group, I get a 503 error, page not found; I would expect to get my default unauthorized page, the login page.

Once I add a proper Not Found page and set the error page to that resource, I get the Not Found page, instead of the Unauthorized page.

This is a MODx Cloud installation. [ed. note: sottwell last edited this post 13 years, 8 months ago.]

To answer my own question (Google is my friend)
https://forums.modx.com/thread/28484/solved-404-page-showing-instead-of-unauthorized-page#dis-post-450040

1. Give the anonymous user load permissions to the resource group and the context.
2. Flush permissions.
3. Flush all sessions.

The last, I presume, was necessary because I was fussing around trying to figure out what was wrong, so had sessions with the wrong permissions laying around.

My rankings must be slipping. I'm surprised you didn't find the "Unauthorized Versus Error Page" section of this page: http://bobsguides.com/revolution-permissions.html

Indeed, I missed that. I'll have to take some time out to read that entire article two or three times.

On reading that, there is a paragraph that I find confusing.

Note that this won't solve the problem for users who are logged on in the front end but are trying to access pages they are not authorized to see. To solve it for those users, add them to the User Groups authorized to see the pages, but with a Role of "Member." Then, Update the User Groups and add another Resource Group Access ACL entry for the group with the Resource Group set to the protected resources, a Minimum Role of "Member" and a policy of "Load Only."

So if group A users are now given "member" access to group B with "load" policy, what should group B users have? All of my users have "member" access and "load" policy in their respective groups.

If I'm understanding you, they should have a more generous policy if you want them to have more rights (IOW, see the page rather then getting the unauthorized page).

What I was trying to say is that when a page is protected for users (i.e., the Resource Group of the page is connected to a User Group they are not a member of and they don't belong to any User Group with a Resource Group ACL entry giving them access to that page), the page doesn't exist for them and they'll get a 404 if they try to access it.

Ok, now I understand. Load, list and view for Resource Group Access and Load for Context Access to actually view the protected pages; Load for both to be able to see that they exist in order to get sent to the unauthorized page. Or at least that's what seems to be working.

I only have one user group at the moment; later I'll need two - one group to access resource group A, and another group to access resource group A plus resource group B. I'm sure I'll fumble around getting that straight when I go for it. I just sincerely hope they never decide they want various manager user group!