uentin
Faulkner

Setting up Restricted Access to Manager Resources

As always, credit to the Author. I am just compiling snippets of code, design ideas, thoughts and ideas, shortcuts and the weird and wonderful in one place, so I have to stop looking for it all the time!

This is going to be very much a work in progress till I do it enough times to get it perfect, but it's pretty close for now.

NB. ALWAYS flush permissions, logoout and then try to browse the site on a new browser, as getting it wrong take sthe website offline, eg. no-one has permissions to access the "web" Context 

  1. Create a new User Group | System Settings> ACL>Create User Group
  2. Use settings as per Image 1 below.
  3. Create a Resource Group | Content > Resource Group > Create Resource Group
  4. Use settings as per Image 2 below
  5. Create a second Administrator Resource Group
  6. Use settings as per Image 3 below
  7. Drag and Drop all top level items into the Administrator Group (it auto-adds children)
  8. Drag and Drop the resources you want visible/editable in the new "Restricted Resources" Group. These are the ones that the new login will have access to.
  9. Go to Users and Create/Link a User to the newly create Restricted Resources Group.
  10. Cross your fingers, flush permissions and logout all users and then login as the above User to check your permissions.

*Tip 1: Login with your restricted user in a different browser in Incognito mode. This way you can check login access, permissions and resource access without having to Logout and In as Administrator every time, just switch between browsers after every tweak. 

*Tip 2: Don't forget to check your User Group's Media Source Access and whether it has FIle / Media SOurce Access (eg. permission to view the Media Manager).

User Groups Documentation

https://docs.modx.com/3.x/en/building-sites/client-proofing/security/user-groups

Resource Groups Documentation

https://docs.modx.com/3.x/en/building-sites/client-proofing/security/resource-groups

Access Policy Documentation

https://docs.modx.com/3.x/en/building-sites/client-proofing/security/policies

Access Policy Defaults

Administrator: Context administration policy with all default permissions..
Context Editor: Context administration policy with limited, content-editing related Permissions, but no publishing Permissions..
Context: A standard Context policy that you can apply when creating Context ACLs for basic read/write and view_unpublished access within a Context..
Element: MODX Element policy with all attributes.
Load Only: A minimal policy with permission to load an object..
Load, List and View: Provides load, list and view permissions only..
Media Source Admin: Media Source administration policy..
Media Source User: Media Source user policy, with basic viewing and using - but no editing - of Media Sources..
Object: An Object policy with all permissions..
Resource: MODX Resource Policy with all attributes.

10