View source for Access Control List Tutorial

==Default ACL Setup== <!--T:73-->
</translate>

<translate><!--T:74-->
When Joomla! is installed, these are set to their initial default settings. We will discuss these initial settings as a way to understand how the ACL works.</translate>

<translate>
===Default Groups=== <!--T:75-->
</translate>

<translate><!--T:76-->
Version 3.x allows you to define your own Groups. When you install version 3.x, it includes a set of default groups, shown below are the basic default User groups. (Additional default User groups are installed with sample data.)</translate>

[[Image:Screenshot_usergroupsl_acl_J3_tutorial-<translate><!--T:77-->
en</translate>.png|center]]

<translate><!--T:78-->
The arrows indicate the child-parent relationships. As discussed above, when you set a permission for a parent group, this permission is automatically inherited by all child groups. The Inherited, and Allowed permissions can be overridden for a child group. The Denied permission cannot be overridden and will always deny an action for all child groups.</translate>

<translate>
===Global Configuration=== <!--T:79-->
</translate>

<translate><!--T:80-->
Joomla! version 2.5 will install with the same familiar Backend permissions as that of version 1.5. However, with 2.5, you can easily change these to suit the needs of your site.</translate>

<translate><!--T:81-->
As discussed earlier, the permissions for each action are inherited from the level above in the permission hierarchy and from a group's parent group. Let's see how this works. The top level for this is the entire site. This is set up in the {{rarr|Site,Global Configuration,Permissions}}, as shown below.</translate>

[[Image:Screenshot_global_acl_J3_tutorial-<translate><!--T:82-->
en</translate>.png]]

<translate><!--T:83-->
The first thing to notice are the ten Actions: Site Login, Admin Login, Offline Access, Super User, Access Administration Interface, Create, Delete, Edit, Edit State. and Edit Own. These are the actions that a User can perform on an object in Joomla. The specific meaning of each action depends on the context. For the Global Configuration screen, they are defined as follows:</translate>

<translate><!--T:84-->
;Site Login : Login to the Frontend of the site

<!--T:85-->
;Admin Login : Login to the Backend of the site</translate>

<translate><!--T:278-->
;Offline Access : Login to the Frontend of the site when the website site is offline (when Global Configuration setting "Site Offline" is set to Yes)</translate>

<translate><!--T:86-->
; Super User : Grants the User "Super User" status. Users with this permission can do anything on the site. Only Users with this permission can change Global Configuration settings (this screen). These permissions cannot be restricted. It is important to understand that, if a User is a member of a Super User group, any other permissions assigned to this User are irrelevant. The User can do any action on the site. However, Access Levels can still be assigned to control what this group sees on the site. (Obviously, a Super User can change Access Levels if they want to, so Access Levels do not totally restrict what a Super User can see.)</translate>

<translate><!--T:87-->
;Access Component: Open the component manager screens (User Manager, Menu Manager, Article Manager, and so on)</translate>

<translate><!--T:88-->
;Create : Create new objects (for example, Users, Menu Items, Articles, Web Links, and so on)</translate>

<translate><!--T:89-->
;Delete : Delete existing objects</translate>

<translate><!--T:90-->
;Edit : Edit existing objects</translate>

<translate><!--T:91-->
;Edit State : Change object state (Publish, Unpublish, Archive, and Trash)</translate>

<translate><!--T:92-->
;Edit Own : Edit objects that you have created.</translate>

<translate><!--T:93-->
Each Group for the site has its own slider which is opened by clicking on the group name. In this case (with the sample data installed), we have the standard 7 groups that we had in version 1.5 plus two additional groups called "Shop Suppliers" and "Customer Group." Notice that our groups are set up with the same permissions as they had in version 1.5. Keep in mind that we can change any of these permissions to make the security work the way we want. Let's go through this to see how it works.</translate>

<translate><!--T:94-->
* '''Public''' has everything set to "Not set", as shown below.</translate>{{-}}[[Image:Screenshot_global_acl_public_J3_tutorial-<translate><!--T:95-->
en</translate>.png]]
<translate><!--T:96-->
**This can be a bit confusing. Basically, "Not Set" is the same as "Inherited." Because Public is our top-level group, and because Global Configuration is the top level of the component hierarchy, there is nothing to inherit from. So "Not Set" is used instead of "Inherit."</translate>
<translate><!--T:97-->
**The default in this case is for no permissions. As you would expect, the Public group has no special permissions. Also, it is important to note that, since nothing is set to Denied, all of these permissions may be overridden by child groups or by lower levels in the permission hierarchy.</translate>

<translate><!--T:98-->
* '''Guest''' is a 'child' group of the Public group has everything set to 'Inherited'</translate> {{-}}[[Image:Screenshot_global_acl_guest_J3_tutorial-<translate><!--T:99-->
en</translate>.png]]
<translate><!--T:100-->
** This is the default 'Guest User Group' in the User Manager options and the Group that (non logged in) visitors to your site are placed in.</translate>

<translate><!--T:101-->
* '''Manager''' is a "child" group of the Public group. It has Allowed permissions for everything except Access Component and Super User. So a member of this group can do everything in the front and Backend of the site except change Global Permissions and Component Options.</translate> {{-}}[[Image:Screenshot_global_acl_manager_J3_tutorial-<translate><!--T:102-->
en</translate>.png]]

<translate><!--T:103-->
* '''Administrator''' group members inherit all of the Manager permissions and also have Allowed for Access Component. So members of this group by default can access the Options screens for each component.</translate> {{-}}[[Image:Screenshot_global_acl_administrator_J3_tutorial-<translate><!--T:104-->
en</translate>.png]]

<translate><!--T:105-->
* '''Registered''' is the same a Public except for the Allow permission for the Site Login action. This means that members of the Registered group can login to the site. Since default permissions are inherited, this means that, unless a child group overrides this permission, all child groups of the Registered group will be able to login as well.</translate> {{-}}[[Image:Screenshot_global_acl_registered_J3_tutorial-<translate><!--T:106-->
en</translate>.png]]

<translate><!--T:107-->
* '''Author''' is a child of the Registered group and inherits its permissions and also adds Create and Edit Own. Since Author, Editor, and Publisher have no Backend permissions, we will discuss them below, when we discuss Frontend permissions.</translate>{{-}}[[Image:Screenshot_global_acl_author_J3_tutorial-<translate><!--T:108-->
en</translate>.png]]

<translate><!--T:109-->
* '''Editor''' is a child of the Authors group and adds the Edit permission.</translate> {{-}}[[Image:Screenshot_global_acl_editor_J3_tutorial-<translate><!--T:110-->
en</translate>.png]]

<translate><!--T:111-->
* '''Publisher''' is a child of Editor and adds the Edit State permission.</translate>{{-}}[[Image:Screenshot_global_acl_publisher_J3_tutorial-<translate><!--T:112-->
en</translate>.png]]

<translate><!--T:113-->
* '''Shop Suppliers''' is an example group that is installed if you install the sample data. It is a child group of Author.</translate>

<translate><!--T:114-->
* '''Customer Group''' is an example group that is installed if you install the sample data. It is a child group of Registered.</translate>

<translate><!--T:115-->
* '''Super Users''' group has the Allow permission for the Super User action. Because of this, members of this group have Super User permissions throughout the site. They are the only Users who can access and edit values on the Global Configuration screen. Users with permission for the Super User action have some special characteristics:</translate>
<translate><!--T:116-->
:* If a User has Super User permissions, no other permissions for this User matter. The User can perform any action on the site.</translate>
<translate><!--T:117-->
:* Only Super Users can create, edit, or delete other Super Users or groups.</translate>

<translate><!--T:118-->
There are two important points to understand from this screen. The first is to see how the permissions can be inherited from the parent Group. The second is to see how you can control the default permissions by Group and by Action.</translate>

<translate><!--T:119-->
This provides a lot of flexibility. For example, if you wanted Shop Suppliers to be able to have the ability to login to the Backend, you could just change their Admin Login value to "Allowed." If you wanted to not allow members of Administrator group to delete objects or change their state, you would change their permissions in these columns to Inherited (or Denied).</translate>

<translate><!--T:120-->
It is also important to understand that the ability to have child groups is completely optional. It allows you to save some time when setting up new groups. However, if you like, you can set up all groups to have Public as the parent and not inherit any permissions from a parent group.</translate>

<translate>
===Component Options and Permissions=== <!--T:121-->
</translate>

<translate><!--T:123-->
Just looking at the Global Configuration screen above, it would appear that the Administrator group and the Manager group have identical permissions. However, in version 1.5 Administrators can do everything except Global Configuration, whereas Managers are not permitted to add Users or work with menu items. That is also true in the default version 2.5 configuration. Let's see how this is accomplished.</translate>

<translate><!--T:124-->
If we navigate to {{rarr|Users,User Manager}} and click the Options button in the toolbar, we see the screen below:</translate>

[[Image:screenshot_acl_tutorial_20110111-09-<translate><!--T:125-->
en</translate>.png|center|]]
[[Image:screenshot_acl_tutorial_20110111-10-<translate><!--T:126-->
en</translate>.png|center|]]

<translate><!--T:127-->
This screen is the same as the Global Configuration Permissions screen, except that these values only affect working with Users. Let's look at how this works.</translate>

<translate><!--T:128-->
First, notice that the Administrator group has Allow permission for the Admin action and the Manager group has Deny permission for this action. Remember that the Admin action in the Global Configuration screen gives the group "Super User" permissions. In this screen, the Admin action allows you to edit the Options values. So, the Administrator group can do this but the Manager group cannot.</translate>

<translate><!--T:129-->
Next, notice that the Administrator has Inherit for the Manage action and the Manager group has Deny permission. In this screen, the Manage action gives a group access to the User Manager. Since the Administrator has Allow for the Manage action by default, then the Inherit permission here means they inherit the Allow permission for the Manage action. Since the Manager group has Deny permission for the Manage action, members of the Manager group cannot access the User Manager and therefore cannot do any of the other User-related actions.</translate>

<translate><!--T:130-->
If you look at the Options for {{rarr|Menus,Menu Manager}}, you will see the same default settings as for the User Manager. Again, the Administrator group can manage and set default permissions for Menu Manager objects whereas the Manager group cannot.</translate>

<translate><!--T:131-->
In short, we can see that the different permissions for the Administrator and Manager groups are set using the {{rarr|Options,Permissions}} forms on the User Manager and Menu Manager screens.</translate>

<translate><!--T:132-->
It is also important to understand that this same {{rarr|Options,Permissions}} form for setting default permissions is available for all Joomla! objects, including Media Manager, Banners, Contacts, News Feeds, Redirect, Search Statistics, Web Links, Extensions, Modules, Plugins, Templates, and Language. So you now have the option to create User groups with fine-tuned sets of Backend permissions.</translate>

<translate>
===Frontend Permissions=== <!--T:133-->
</translate>

<translate><!--T:134-->
Default permissions for the Frontend are also set using the Options form. Let's look at {{rarr|Content,Article Manager,Options,Permissions}}. First, let's look at the permissions for Manager, as shown below.</translate>
[[Image:screenshot_acl_tutorial_20110111-11a-<translate><!--T:135-->
en</translate>.png|center|frame]]
<translate><!--T:136-->
Manager has allowed permission for all actions except Configure. So members of the Manager group can do everything with Articles except open the Options screen.</translate>

<translate><!--T:137-->
Now let's look at Administrator, as shown below.</translate>
[[Image:screenshot_acl_tutorial_20110111-12a-<translate><!--T:138-->
en</translate>.png|center|frame]]
<translate><!--T:139-->
Administrator has Allowed for Configure, so Administrators can edit this Options screen.</translate>

<translate><!--T:140-->
Both groups can create, delete, edit, and change the state of articles.</translate>

<translate><!--T:141-->
Now, let's look at the groups Publisher, Editor, and Author and see how their permissions are set.</translate>

<translate><!--T:142-->
Authors only have Create and Edit Own permissions, as shown below.</translate>
[[Image:screenshot_acl_tutorial_20110112-07-<translate><!--T:143-->
en</translate>.png|center|frame]]
<translate><!--T:144-->
This means that Authors can create articles and can edit articles they have created. They may not delete articles, change the published state of articles, or edit articles created by others.</translate>

<translate><!--T:145-->
Editors have the same permissions as Authors with the addition of permission for the Edit action, as shown below.</translate>
[[Image:screenshot_acl_tutorial_20110112-08-<translate><!--T:146-->
en</translate>.png|center|frame]]
<translate><!--T:147-->
So Editors can edit articles written by anyone.</translate>

<translate><!--T:148-->
Publishers can do everything Editors can do plus they have permission for the Edit State action, as shown below.</translate>
[[Image:screenshot_acl_tutorial_20110112-09-<translate><!--T:149-->
en</translate>.png|center|frame]]
<translate><!--T:150-->
So Publishers can change the published state of an article. The possible states include Published, Unpublished, Archived, and Trashed.</translate>

<translate><!--T:151-->
All of these groups have Inherit permission for Configure and Access Component. Remember that Author is a child of the Registered group, and Registered does not have any default permissions except for Login. Since Registered does not have permission for Configure and Access Component, and since Author's permission for these actions is "Inherited", then Author does not have these permissions either. This same permission is passed from Author to Editor and from Editor to Publisher. So, by default, none of these groups are allowed to work with articles in the Backend.</translate>

<translate><!--T:152-->
It is important to remember that these permissions are only default settings for categories and articles and for any child groups that are created. So they can be overridden for child groups, for categories, and for specific articles.</translate>

<translate><!--T:153-->
Also, note that there are no Denied permissions for any actions in the default settings. This allows you to add Allowed permissions at any level. Remember, once you have an action set for Denied, this action will be denied at all lower levels in the hierarchy. For example, if you set the Admin Login for Registered to Denied (instead of Allowed), you could not grant Publishers Allowed permissions for this action.</translate>

<translate>
=== Article Manager and Actions Diagram === <!--T:154-->
</translate>

<translate><!--T:155-->
The diagram below shows how each action in the permissions form relates to the various options on the Article Manager screen.</translate>

[[Image:screenshot_acl_tutorial_20110111-16-<translate><!--T:156-->
en</translate>.png|center|]]

<translate><!--T:157-->
* '''Configure''' allows you to view and change the Options for the component.</translate>
<translate><!--T:158-->
* '''Access Component''' allows you to navigate to the Article Manager. Without this permission, no other actions are possible.</translate>
<translate><!--T:159-->
* '''Create''' allows you to add new articles.</translate>
<translate><!--T:160-->
* '''Delete''' allows you to delete trashed articles. Note that the Delete icon only shows in the toolbar when you have the "Select State" filter set to "Trash."</translate>
<translate><!--T:161-->
* '''Edit''' allows you to edit existing articles.</translate>
<translate><!--T:162-->
* '''Edit State''' allows to you Publish, Unpublish, Archive, or Trash articles.</translate>
<translate><!--T:163-->
* '''Edit Own''' is the same as Edit except that it only applies to articles written by you.</translate>

<translate>