Permissions hell

A user, 'member1', belongs to the user group 'Members'.

A resource, 'testing', belongs to the resource group 'Protected'.

Members has User Group Access to Restricted Protected:

Context - web
Access Policy - Load, List and View
Minimum Role - Member - 9999

This is exactly the same access the Anonymous group has. An anonymous user can view the page. The 'member1' user gets the not-found page.


[ed. note: sottwell last edited this post 12 years ago.]

Does the Members group have a Context Access ACL for the context the resource is in? See the anonymous group's context access ACL entry.

Also, in your message you called the group 'Restricted' in one place an 'Protected' in another. Probably a typo, but if not, that would do it.

Don't forget to flush permissions -- and sessions -- after any changes.

Yeah, it's all Restricted. I shouldn't post when frustrated. Actually I was fiddling with different groups/permissions combinations trying to figure out a NewsPublisher issue. But that's another story

Members user group has load, list, view access to web context. anonymous has load only.

After a reasonably good night's sleep, it's back to the trenches. I'll post the solution when I get it (and I will, eventually) just for anybody else who is also having problems with this kind of thing. [ed. note: sottwell last edited this post 12 years ago.]

Well, I found one solution. When you create a new resource group, you get the Wizard. For the Restricted resource group, I had checked the boxes for giving anonymous and Administrator view permissions. They could see the page just fine. Manually adding the Members group later with exactly the same context and policy is where the problem came in - Member users got the not-found page.

When updating a resource group all you get is a field to change its name.

So I created a new resource group, Protected. This time, I checked the boxes for giving view access to the anonymous and Adminsitrator groups, and added the Members group to the field for adding groups to be given view access. That works just fine.

I have other fish to fry for now, so this will have to wait for further investigation.

Hm. Fish. Fry. I happen to have some pretty good fish in the freezer...I think I'll get some out to thaw for my lunch. [ed. note: sottwell last edited this post 12 years ago.]

When updating a resource group all you get is a field to change its name.

I found this frustrating a bit illogical as well, but if you go to Access Controls and go to your Members User group and edit that, you can then add the Restricted group there, to allow them to view it.

That's what I did, and it just wasn't working. Maybe I didn't clear permissions enough or something. I don't feel like poking at it any more just to try to find out what was wrong, since it's working OK now.