Limit user's manager access to blog only

24,544 Posts

BobRay Reply #11, 13 years, 1 month ago

It seems to me that you are complicating things by using both Contexts and Resource Groups to control access. If the Resources you want to hide are all in a separate context, you shouldn't need Resource Groups for them.

It they're all in a Resource Group and you've protected Resources outside the group, you shouldn't need a separate Context.

Using multiple Contexts definitely complicates things, especially if front-end links will lead a user from one context to another, though it adds certain conveniences. I try to avoid extra contexts when I can. YMMV.

Did I help you? Buy me a beer
Get my Book: MODX:The Official Guide
MODX info for everyone: http://bobsguides.com/modx.html
My MODX Extras
Bob's Guides is now hosted at A2 MODX Hosting

48 Posts

krajicek Reply #12, 13 years, 1 month ago

Quote from: BobRay at Sep 10, 2013, 02:06 PM

It seems to me that you are complicating things by using both Contexts and Resource Groups to control access. If the Resources you want to hide are all in a separate context, you shouldn't need Resource Groups for them.

It they're all in a Resource Group and you've protected Resources outside the group, you shouldn't need a separate Context.

Using multiple Contexts definitely complicates things, especially if front-end links will lead a user from one context to another, though it adds certain conveniences. I try to avoid extra contexts when I can. YMMV.

Hi Bob,

i'm using multiple contexts because of multilanguage site which i built following the method described by Menno Pietersen (his site http://www.designfromwithin.com/ is unfortunately down recent days but video outlining the method can be seen here https://www.youtube.com/watch?v=fSa_CdinTUE)

so what i'm after is multilingual site + english blog which will be common for all languages. i moved the blog to separate context to be able to limit access to it for some back-end (manager) users

i also dropped my "Resource Groups" as these are not necessary as you mentioned however the system behaves as before = no front-end access to blog + Error! Access denied. for "limited" user when clicking on "blog" context although "test-blog" instance of Articles extra under "blog" context is accessible for him

kr [ed. note: krajicek last edited this post 13 years, 1 month ago.]

48 Posts

krajicek Reply #13, 13 years, 1 month ago

Quote from: Tyreal2012 at Sep 10, 2013, 11:16 AM

Have you set the contexts in the ACL? otherwise you might still be looking at mgr and web, when your blog is stored in the blog context.

Hi Tyreal2012,

thanks for reply. where exactly should i look to be able to answer your question?

kr

24,544 Posts

BobRay Reply #14, 13 years, 1 month ago

In order to see Resources in the tree, a User Group needs to have a Context Access ACL entry for each Context.

Security -> Access Controls -> User Groups tab.

Right-click on each group and select "Update User Group"

Go to the "Context Access" tab.

Make sure there's an entry for every context they need to see Resources in, and make sure they meed the Minimum Role (i.e., their Role has an authority number less than or equal to the Minimum Role).

Did I help you? Buy me a beer
Get my Book: MODX:The Official Guide
MODX info for everyone: http://bobsguides.com/modx.html
My MODX Extras
Bob's Guides is now hosted at A2 MODX Hosting

463 Posts

Tyreal2012 Reply #15, 13 years, 1 month ago

What bob said ^^

And dont forget to flush permissions afterwards.

48 Posts

krajicek Reply #16, 13 years, 1 month ago

Quote from: BobRay at Sep 11, 2013, 02:45 AM

In order to see Resources in the tree, a User Group needs to have a Context Access ACL entry for each Context.

Security -> Access Controls -> User Groups tab.

Right-click on each group and select "Update User Group"

Go to the "Context Access" tab.

Make sure there's an entry for every context they need to see Resources in, and make sure they meed the Minimum Role (i.e., their Role has an authority number less than or equal to the Minimum Role).

My ACL look like this:

anonymous

web   Member - 9999   Load Only
DE    Member - 9999   Load Only
FR    Member - 9999   Load Only
blog  Member - 9999   Load, List and View

Administrator

mgr   Super User - 0   Administrator
web   Super User - 0   Administrator
DE    Super User - 0   Administrator	
FR    Super User - 0   Administrator
blog  Super User - 0   Administrator
--- 
mgr   Member - 9999   QuipModeratorPolicy

test

blog  Member - 9999   Content Editor
mgr   Member - 9999   Content Editor

+ no entries in Resource Group Access, Element Category Access & Media Source Access

kr

48 Posts

krajicek Reply #17, 13 years, 1 month ago

i wonder, lads, does the above look correct?

if you could have a look pls.

just to explain:
what i'm trying to achieve is to have multi language site + 1 blog (english only)

in front-end i'd also like to be able to do language specific search

in back-end i'd like to have users which can edit both blog entries + multi language site content
but also users which can edit only site content and other users which can edit blog entries only. if i type edit i mean of course also create / delete. i think i saw somewhere in policies also option to allow/deny publishing of new content / blog entries

thnx
kr

[ed. note: krajicek last edited this post 13 years, 1 month ago.]

463 Posts

Tyreal2012 Reply #18, 13 years, 1 month ago

Sorry I was having my own ACL troubles.

It looks ok, the easiestway to test it is to actually log in to your specified user in another browser and try it. on the top level it looks ok, although you might want to create a duplicate of the content editor policy as the basic one supplied doesnt allow file access to upload images etc.

You might need to set up the Resource Groups for blog only as well (i think).

48 Posts

krajicek Reply #19, 13 years, 1 month ago

Thank all of you (mainly Bob's guide and MODX ACL Security Tutorial) i succeeded to set it up almost the way i wanted

sharing my setup so it maybe helps somebody or you can let me know if there's anything that can be done better or more simple (thank you in advance)

Summary & Goal:
i'm building multi-language site (EN,DE,FR) using Babel extra with blog (english only) using Articles extra:
- on front-end side everything should be accessible to anybody = site content + blog articles
- on back-end side i'd like to have 4 user groups = 2 coming with Revo installation = anonymous, Administrator + 2 new groups = editors & bloggers
* editors - have access to site content + blog articles
* bloggers - have access to blog articles only

My setup steps:

i have 3 contexts
"web" - containing documents for english content of the site and also blog (container alias = test-blog) is here
"DE" - containing documents for german content of the site
"FR" - containing documents for french content of the site

Created 2 new Roles

   Content_and_Blog_Editor   authority = 7000
   Blogger		     	authority = 8000

Created 2 new Access Policies via duplicating the existing policies (no customizing so far)

   Resource (Bloggers)   ResourceTemplate		12 of 14
   TEST Content Editor   AdministratorTemplate		24 of 172

Created 2 new User Groups

   bloggers
   content_and_blog_editors

Created 2 new Users

	
   blogger1 - added to "bloggers" User Group with "Blogger" Role
   editor1 - added to "content_and_blog_editors" User Group with "Content_and_Blog_Editor" Role

Added "admin" user into "bloggers" and "content_and_blog_editors" User Groups with "Super User" Role

Created 2 Resource Groups

	
	blog_only - assigned blog only to this one
	site_content_and_blog - assigned site content in all the contexts (web, DE, FR) + blog to this one

For following User Groups i adjusted / created Content Access (CA) and Resource Group Access (RGA) like this:

Administrator User Group

Users
	admin		Super User - 0

CA
	mgr		Super User - 0		Administrator
	web		Super User - 0		Administrator
	DE		Super User - 0		Administrator
	FR		Super User - 0		Administrator

	mgr		Member - 9999			QuipModeratorPolicy
		
RGA
	blog_only			Member - 9999		Resource		mgr
	site_content_and_blog		Member - 9999		Resource		mgr

bloggers User Group

Users
	admin		Super User - 0
	blogger1	Blogger - 8000
		
CA
	mgr		Blogger - 8000		TEST Content Editor

	web		Member - 9999		Context
		
RGA
	blog_only		Super User - 0		Resource			mgr

	blog_only		Blogger - 8000		Resource (Bloggers)		mgr
	blog_only		Blogger - 8000		Resource (Bloggers)		web (added to be able to see the blog in front-end)

content_and_blog_editors User Group

Users
	admin		Super User - 0
	editor1		Content_and_Blog_Editor - 7000
		
CA
	mgr		Content_and_Blog_Editor - 7000		TEST Content Editor

	DE		Member - 9999				Context
	web		Member - 9999				Context
	FR		Member - 9999				Context
		
RGA
	site_content_and_blog		Super User - 0		Resource	mgr

	site_content_and_blog		Content_and_Blog_Editor - 7000	Resource (Bloggers)		mgr
	site_content_and_blog		Content_and_Blog_Editor - 7000	Resource (Bloggers)		web
	site_content_and_blog		Content_and_Blog_Editor - 7000	Resource (Bloggers)		DE
	site_content_and_blog		Content_and_Blog_Editor - 7000	Resource (Bloggers)		FR

Problems
- when editor1 or blogger1 are logged in into Manager and they click on context (e.g. "web" for blogger1 or "DE" for editor1) in Resources side bar it results in blank page with message:
Error!
Access denied.

- when blogger1 is logged in into Manager he cannot see the site content in the front-end. he can see the blog only.

I'd like to not get the error message described above when contexts are clicked.
Also if it is possible i'd like to have blogger's access limited in Manager only, not in front-end. In current setup he needs to use either 2 web browsers or to log out when he wants to see the site content.

I hope this could help somebody
If you spot any errors above or know how to do this better or more simple way or how to resolve the problems mentioned above please let me know

Thank you in advance
kr
[ed. note: krajicek last edited this post 13 years, 1 month ago.]

24,544 Posts

BobRay Reply #20, 13 years, 1 month ago

You should be able to remove *all* RGA entries with a front-end context. That should allow everyone to see everything in the front end and shouldn't restrict Manager access to anything -- as long as you remove them all (then flush permissions and sessions).

If that works, I think you can eliminate the "Access Denied" problem by taking away their CA entries for the contexts that give the errors. That should hide the web and DE folders in the Manager. Blogger1 won't see any resources in the tree unless they're outside they're outside the 'web' context. I'm not sure if that's what you want.

Did I help you? Buy me a beer
Get my Book: MODX:The Official Guide
MODX info for everyone: http://bobsguides.com/modx.html
My MODX Extras
Bob's Guides is now hosted at A2 MODX Hosting