[opencms-dev] Re: Permissions howto

[Joe Desbonnet]

Regarding my question about allowing UserA to edit content in FolderA
and UserB content in FolderB etc, this is how far I've gotten...

I've created groups GroupA and GroupB. UserA is a member of GroupA and
UserB is a member of GroupB.

Both GroupA and GroupA have "Users" as the parent Group.

I have a website located in /sites/MySite  (relative to VFS root).

While logged in as Admin and Site set to "/", I have selected the
permissions for the "/sites/MySite" folder. For
"Directect Publish" and "Write" permissions I've unchecked "Allowed"
and checked
"Denied."   I've also checked "Overwrite inherited" and "Inherit on subfolders"

At this point UserA and UserB cannot edit any content as expected.  So
far so good.

Now I have a folder called "FolderA" under "MySite". Ie the full VFS path is
/sites/MySite/FolderA

I want members of GroupA to have edit access to that content.  So this
is what I've done: While logged into Admin I've set the permissions on
"FolderA" as follows:

Add new group permission. I select group "GroupA". I check "Write" and
"Direct Publish"
under the "Allowed" column. I also check "Overwrite inherited" and
"Inherit on subfolders". I leave all other checkboxes unchecked.

However this does not allow UserA to edit content in FolderA as
expected. It's telling me I need +w permission. But UserA should have
+w permission because it's a member of GroupA .... So what am I doing
wrong?

Joe.


On 8/4/06, Joe Desbonnet <jdesbonnet at gmail.com> wrote:
> Is there any documentation/howtos on the OpenCms permissions/access
> control system? Despite having deployed several OpenCms projects I
> still cannot make head nor sense of the permissions system.
>
> For example how do I do the following:
>
> UserA must be able to edit only /FolderA/... but read everything else
> on the site.
> UserB must be able to edit only /FolderB/... etc...
>
> I would imagine this is one of the most common types of permissions
> setup. I suspect there is 100 ways of doing this ... but if someone
> can give me the details for just one method I'll figure out the rest.
>
> Thanks,
>
> Joe.
>