|
The permission system in eZ allows you to very precisely define which us= ers have access to which functions of the website. |
The permission system in eZ is complex, multi-level and very flexible.
Users can be assigned to User groups. Both User groups and individual Us= ers can be assigned Roles and Policies, further defined with the use of Lim= itations.
Roles and Policies are set up in the Admin Panel.
=20- =20
- Permissions overview =20
- Roles=20 =20
- Policies=20
- =20
- Adding Po= licies =20
=20
- Limitations=
=20
- =20
- Add= ing limitations =20
=20
Permissions overview
Overview of the permission system in eZ is best presented using an examp= le:
Let us assume you are managing a newspaper website. Your crew consists o= f an editor-in-chief and several editors responsible for particular section= s of the paper: general news, local news, sports etc. You also have contrib= utors who occasionally add new articles.
You want to give the editor-in-chief access to most parts of your websit= e, but the individual editors will only work with their own sections. To th= e contributors you want to give the permissions to create new Content, but = not to modify or delete existing Content.
In order to have this setup you need to create a number of different Roles: = Editor-in-Chief, different Editor(s) and Contributor.
Even if you plan on having only one editor-in-chief, it is good pra= ctice to create a User group to contain this user, and assign a Role t= o it instead of assigning permissions directly to the user.
To each of these Roles you need to assign proper Policies, giving them the rig= ht to perform certain actions.
The Editor-in-Chief Role would have the most Policies (although you may = want to reserve some more advanced permissions only for system administrato= rs). Regular Editors need Policies allowing them to create, modify and dele= te Content. Contributors can be given Policies permitting them to only crea= te Content.
If you want to prohibit Editors from accessing Content from newspaper se= ctions other than their own, you can add limitations to their Policies. This m= eans that instead of one Editor you need to have separate Roles for each ed= itor profile: Local Editor, Sports Editor etc. All of these Roles will have= the same Policies, but to each Policy you need to assign a limitation whic= h would mean that the permission covers only one Section (= sports section, local news section etc.) that the editor works in.
Aside from Policies that define access to Content items, there are also = many other Policy types concerned with administrating the system. They cove= r actions such as activating new Users, creating Sections, modifying Conten= t Types etc.
See also:
For technical information on the permission system, see Permissions.
Roles
A Role consists of a number of Policies, each of which defines access to= one functionality of one module (for example modifying articles).
Creating new Roles
1. In the Navigation hub click Admin panel.
2. Select Roles.
A list appears with all the currently configured Roles.
3. Click Create a role below the table= .
4. Enter the name of the new Role and click Sav= e.
=20
<= span class=3D"confluence-anchor-link" id=3D"Managingpermissions-AssigningRo= lestoUsers">Assigning Roles to Users
1. In the Navigation hub click Admin panel and select Roles.
2. Click Assign to users/groups next t= o the Role you want to modify.
The Universal Discovery Widget opens.
3. In the Users category select the Users or User group= s you want to assign the Role to.
You can select more than one User or User group in this way. Naviga= te to each of them and click Choose this content. This Use= r (or group) will be added to a list at the bottom left of the Discovery Wi= dget. If you want to remove a previously selected User, click this list and= remove the entry from it.
4. Click Confirm selection.
=20A User (or User group) can be assigned more than one Role.
Unassigning Roles
1. In the Navigation hub click Admin panel and select Roles.
2. Click the name of the Role you want to modify.
3. In the Role view, switch to the Users and gr= oups using the <Role name> role tab.
4. Click Delete assignment next to the= User or group you want to unassign.
=20
Policies
A Policy can be understood as a permission for a single action in a spec= ified part of the website system. Each Role can be assigned any number of P= olicies.
A Policy consists of:
- module - the part of the website or system it concerns, for example: Co= ntent, User, Role, Section
- function - the action on the module it allows, for example: Create, Edi= t, Assign
- (optional) limitations
Note
By default a User or User group has no permissions. Roles and Policies a=
re used to grant permissions to do something, not to
Ad= ding Policies
1. In the Navigation hub click Admin panel and select Roles.
2. Click the name of the Role you want to modify.
A list of all Policies of this Role appears.
3. Click Add new policy below the list= .
4. Select a combination of module and function in the <= strong>Policy type menu.
The menu lists all possible operations on all modules existing in = the system.
5. Click Save to confirm the new Polic= y.
Click Save and add limitations if you want to imme= diately add limitations to the new Policy. You can also simply save it for = now and add limitations later.
It is also possible to create your own Policies, other than the pre= set ones. For more information see Custom policies.
Limitations=
Limitations further specify permissions granted by a Policy by narrowing= their scope. For example, a limitation may state that a given Policy cover= s only a selected Content Type or Section.
= Adding limitations
1. In the Navigation hub click Admin panel and select Roles. Click the name of the Role you want= to modify.
2. Click Edit limitations next to the = selected Policy.
A screen appears with a list of possible limitations. The types of limit= ations depend on the type of the Policy your are editing. For some Policies= no additional limitations are available.
3. Select a limitation (or limitations) from one or mor= e of the lists.
If you want to select more than one limitation of the same type (fo= r example, several Sections), Ctrl-click or Command-click all these items o= n the list.
4. Click Save.
Details of the chosen limitation appear in the Policies list.
To change the name of an existing Role, click its name in the list = to view its details and then click Edit role name. In this= screen you can also remove a Role by clicking Delete.
See also:
For technical information on limitations, see Limitations reference.