Roles, groups and users
The system of roles, groups, and users makes the role or group assignment process efficient so that, for example, onboarding new editors or publishers becomes a simple assignment to a group or role.
With privileges being usually highly granular in a fully deployed authoring and publishing configuration, it’s possible to segment the editing experience further by app and workspace access, and without custom roles.
This reduces the overall complexity, particularly for projects with external user management.
Managing roles, groups, and users
Use the Security app to manage the assignment of roles, groups, and users.
Default roles, groups, and users in DX Core webapp
Roles
Except the anonymous, scripter and superuser roles, system of roles follows a unified role naming convention of type <module>-<privilege> (for example pages-publisher, admincentral-editor).
| Role | Description |
|---|---|
|
Allows users to read the |
|
Allows users to enter the Admincentral (permissions to the |
|
Base role for public, unauthenticated users. |
|
Allows users to edit assets (stored in the |
|
Base role allowing users to read categorization information. |
|
Allows users to edit content categories (stored in the |
|
Allows users to read content on the |
|
Allows users to edit content in the |
|
Allows users to read the content on the |
|
Allows users to access the web path |
|
Allows editing content. |
|
Allows users to read the |
|
Base role allowing users to read the |
|
Allow users to access the |
|
Allow users to access update content in the |
|
Allows users to access and update content in the |
|
Allows users to access and update content in the |
|
Base role allowing users to use the |
|
Allows web content retrieval from the |
|
REST administrator role granting GET/POST permissions to all Magnolia’s REST APIs. |
|
REST Anonymous Consumer granting GET permissions to Magnolia’s content delivery REST API. |
|
Allows executing backup command from a running magnolia instance. |
|
REST editor role. |
|
Base role allowing users to use |
|
Base role denying to certain system pages. |
|
Base role allowing users to read stories. |
|
Allows users to read and create stories (in the |
|
A user with unrestricted access to all content everywhere. |
|
Base role allowing users to use the workflow. |
|
Allows users to edit content. |
|
Allows users to publish content. |
Groups
The purpose of groups is to define settings for a group of users, as opposed to individual users. Users with similar privileges are assigned to appropriate groups. Permissions that apply to a group are inherited by its users.
In the Magnolia DX Core webapp, there are no pre-defined groups.
In magnolia-core, however, these three default groups (JCR primary type mgnl:group) are available:
-
developers -
editors -
publishers
Other modules can use these default groups for role assignments.
If you create a new user and give it the superuser role, it won’t get task notifications by default.
They are only sent when the user is added to the publishing group.
|