View source for Access Control List Tutorial

=Actions, Groups, and Inheritance=

The other side of ACL is granting permissions to users to take actions on objects. Here again there is a big change between Version 1.5 and 1.6. In 1.5, the actions allowed for a given group were fixed. For example, a User in the Author group could only submit an article whereas someone in the Publisher group could submit, edit, and publish articles. Also, in version 1.5 the permissions were all-or-nothing. A member of the Editor group could edit all articles on the site.

The table below shows what has changed between versions 1.5 and 2.5 series (including 1.6 and 1.7).

{| class="wikitable"
!style="width:20%;"|
!Version 1.5
!2.5 series
|-
!Groups and Actions
|Actions allowed by different groups are fixed.
|Actions allowed for each group are defined by site administrator.
|-
!Permission Scope
|Entire Site. User has same permissions for all objects on the site.
|Permissions can be set at multiple levels in hierarchy: Site, Component, Category, Object.
|-
!Permission Inheritance
|Not applicable
|Permissions can be inherited from parent Groups and parent Categories
|}

==How Permissions Work==

There are four possible permissions for actions, as outlined below:

* '''Not set''': Defaults to "deny" but, unlike the Deny permission, this permission can be overridden by setting a child group or a lower level in the permission hierarchy to "Allow". This permission only applies to the Global Configuration permissions. 
* '''Inherit''': Inherits the value from a parent Group or from a higher level in the permission hierarchy. This permission applies to all levels except the Global Configuration level.
* '''Deny''': Denies this action for this level and group. '''IMPORTANT:''' This also denies this action for all child groups and all lower levels in the permission hierarchy. Putting in Allow for a child group or a lower level will not have any effect. The action will always be denied for any child group member and for any lower level in the permission hierarchy.
* '''Allow''': Allows this action for this level and group and for lower levels and child groups. This does not have any effect if a higher group or level is set to Deny or Allow. If a higher group or level is set to Deny, then this permission will always be denied. If a higher group or level is set to Allow, then this permission will already be allowed.

==Permission Hierarchy Levels==

Action permissions in version 2.5 can be defined at up to four levels, as follows:
# '''Global Configuration''': determines the default permissions for each action and group. 
# '''Component Options->Permissions''': can override the default permissions for this component (for example, Articles, Menus, Users, Banners, and so on)
# '''Category''': can override the default permissions for objects in one or more categories. Applies to all components with categories, including Articles, Banners, Contacts, Newsfeeds, and Weblinks. 
# '''Article''': Can override the permissions for a specific article. This level only applies to articles. Other components only allow the first three levels.

===Global Configuration===
This is accessed from Site &rarr; Global Configuration &rarr; Permissions. This screen allows you set the top-level permission for each group for each action, as shown in the screenshot below. 
[[Image:screenshot_acl_tutorial_20110111-01.png|center]]
The options for each value are Inherited, Allowed, or Denied. The Calculated Setting column shows you the setting in effect. It is either Not Allowed (the default), Allowed, or Denied.

You work on one Group at a time by opening the slider for that group. You change the permissions in the Select New Settings drop-down list boxes. 

Note that the Calculated Setting column is not updated until you press the Save button in the toolbar. To check that the settings are what you want, press the Save button and check the Calculated Settings column.

===Component Options->Permissions===
This is accessed for each component by clicking the Options icon in the toolbar. This screen is similar to the Global Configuration screen above. For example, clicking the Options toolbar icon in the Menu Manager shows the Menus Configuration below.
[[Image:screenshot_acl_tutorial_20110111-02.png|center]]
Access to Options is only available to members of groups who have permission for the Configure action in for each component. In the example above, the Administrator group has Allowed permission for the Configure option, so members of this group can access this screen.

===Category===
Category permissions are accessed in the Category Manager: Edit Category screen, in a slider at the bottom of the screen. This screen has five permissions, as shown below.
[[Image:screenshot_acl_tutorial_20110111-03.png|center]]
In these screens, you work on the permissions for one User Group at a time. In the example above, we are editing the permissions for the Administrator group.

Note that the Configure and Access Component actions do not apply at the category level, so those actions are not included.

Note also that Categories can be arranged in a hierarchy. If so, then action permissions in a parent category are inherited automatically by a child category. For example, if you had a category hierarchy of Animals &rarr; Pets &rarr; Dogs, then the full permission level hierarchy for an article in the Dogs category would be as follows:
* Global Configuration
* Article Manager &rarr; Options &rarr; Permission
* Animals Category
* Pets Category
* Dogs Category
* specific article

===Article===
Permissions for a single article are access in the Article Manager: Edit Article screen, again in a slider at the bottom of the screen. This screen has three actions, as shown below.
[[Image:screenshot_acl_tutorial_20110111-04.png|center]]
Again, you edit each group by clicking on it to open the slider for that group. You can then change the permissions under the Select New Setting column. To see the effect of any changes, press the Save button to update the Calculated Setting column.

Note that the Configure, Access Component, and Create actions do not apply at the article level, so these actions are not included. Permission to create an article is set at one of the higher levels in the hierarchy.

==Access Levels==

Access Levels in 2.5 series are simple and flexible. The screen below shows the Special Access Level.  
[[Image:screenshot_acl_tutorial_20110111-05.png|center]]
Simply check the box for each group you want included in that level. The Special Access Level includes the Manager, Author, and Super Users groups. It also includes child groups of those groups. So, Administrator group is included, since it is a child group of the Manager group. The Editor, Publisher, and Shop Suppliers groups are included, since they are child groups of Author. (Note that we could check all of the child groups if we wanted and it wouldn't hurt anything.)

Once Access Levels are created, they are used in the same way as in version 1.5. Each object in the front end is assigned an Access Level. If the level is Public, then anyone may access that object. Otherwise, only members of groups assigned to that access level may access that object. Access levels are assigned to Menu Items and to Modules. Each one can only be assigned to one access level.

For example, the screen below shows the Edit Menu Item screen with the list of available access levels.

[[Image:screenshot_acl_tutorial_20110111-06.png|center]]