Limit user's manager access to blog only

Hi modx-ers

i wonder would it be possible to have user(s) which have access to blog articles (Articles extra) while access to other website content = documents would be restricted?

i'm just starting to look into modx user management history. so far it seems to be quite complex.

could you please explain how to achieve above scenario if is it possible?

thank you in advance
be well
kr [ed. note: krajicek last edited this post 13 years, 1 month ago.]

ACLs are pretty complex at first but once you understand how they work they offer you a lot of flexibility, check out my ACL Tutorial so you can learn how security works in MODX.

Good Luck.

Do you mean in the Manager, or in the front end of the site?

Quote from: benmarte at Sep 09, 2013, 09:10 AM

ACLs are pretty complex at first but once you understand how they work they offer you a lot of flexibility, check out my ACL Tutorial so you can learn how security works in MODX.

Good Luck.

Thank you, benmarte, looks like comprehensive tutorial

kr

Quote from: BobRay at Sep 09, 2013, 02:08 PM

Do you mean in the Manager, or in the front end of the site?

Hi, BobRay, i mean in the Manager

kr

The short version is:

1. Put all the Resources on the site in a Resource Group called AllDocs (use the DefaultResourceGroup plugin to make sure all future docs go in that group).

2. Create a Resource Group Access ACL entry connecting the AllDocs group with the Administrator user group (make sure the users in question aren't in that group) with a context of 'mgr' and a policy of Resource.

At this point the users won't see anything.

3. Put the users in their own User Group.

4. Put the Articles in a Resource Group Called ArticlesResources.

5. Create a Resource Group Access ACL entry connecting the ArticleResources Resource Group with the User Group of the users -- context of 'mgr', Policy of Resource, Authority level of whatever the users have.

That should do it.

The Users will need a Context Access ACL entry with a context of 'mgr' in order to log in to the Manager.
They'll also need another Context Access ACL entry with a context of 'web' to allow them to see the Resources in the tree.

For the first of these, you'll want to either use the Content Editor Policy, or if that doesn't work for you, create a new Policy based on the Administrator Template and uncheck permissions you don't want them to have (access_permissions should definitely be unchecked).

There are some more tutorials here: -- see the menu at the bottom of the page for specific tutorials.

thank you Bob for very useful website - really lot of info there

ok. made it partially working.

1. duplicated "web" context and named new instance "blog"
2. created "Articles" under new "blog" context with Container Alias = "test-blog"
3. gave new "blog" context these settingscultureKey=en; base_url=/mysite/blog/; site_url=http://mydomain/mysite/blog/; site_start=...
4. created a User Group called "test" and gave it Context Access to
"mgr" context with role "Member - 9999" and policies "Content Editor"
"blog" context with role "Member - 9999" and policies "Content Editor"
5. created user "limited" and added it to User Group "test"
6. created Resource Group named "blog" and drag&dropped there "test-blog" resource
7. checked the "anonymous" User Group context access and it is like this:

Flushed the sessions and cleared the cache

now in different browser when i log in as "limited" user i can see only Resources on the left and under it "blog" context and "test-blog" within it.
when i click "test-blog" i can add blog articles etc.
so far so good.

but

when i click "blog" context i get blank page with:
Error!
Access denied.

in front-end i cannot access the blog at all

none of these works:
http://mydomain/mysite/blog/
http://mydomain/mysite/blog/test-blog
http://mydomain/mysite/test-blog


could you please advise what i did wrong please?
thank you in advance
kr

If you made a new context you need to user ContextRouter and add some Context Settings in order to access the blog context, I discuss this in another of my tutorials at my blog here.

Hopefully that helps solve your problem, good luck.

Quote from: benmarte at Sep 10, 2013, 09:16 AM

If you made a new context you need to user ContextRouter and add some Context Settings in order to access the blog context, I discuss this in another of my tutorials at my blog here.

Hopefully that helps solve your problem, good luck.

Thank you Benjamin, tried to install ContextRouter + i already have base_url, site_start, site_url & cultureKey set for each context. unfortunately it still does not work.

i probably need to add also that http_host setting ...

thank you for tip
kr


EDIT:
tried also add http_host setting but did not work [ed. note: krajicek last edited this post 13 years, 1 month ago.]

Have you set the contexts in the ACL? otherwise you might still be looking at mgr and web, when your blog is stored in the blog context.