In a nutshell:
Restrict component's EDITION via configuration.
In details:
I have some roles defined in the Magnolia's Security app. I would like to restrict access (allowing to edit a component) to a dialog to a given role.
i.e. I have a custom form component with sensitive configuration in the its dialog (content of emails sent & so on) and I need to restrict the access to the relevant tabs or fields to superuser
Info I found
I looked into the Dialog Definition documentation of Magnolia CMS and found nothing on this topic.
What I tried
I tried following a similar pattern as the one used for Magnolia CMS' Template availability by role, using a roles node with a relevant child property (i.e. superuser property with value superuser).
But no luck, whether I add this node on the <formName>, form, tabs, <tabName> or fields level.
Related
I'm new to angular and am now developing a role management dashboard where a super-admin can assign and manage roles(possible roles: 'school admin', 'Teacher', 'Student', 'Parent') and their permissions respectively by clicking the check boxes.
NOTE: Refer the image for role management dashboard.
I found this link "https://jasonwatmore.com/post/2018/11/22/angular-7-role-based-authorization-tutorial-with-example" to be helpful when I tested to assign the permissions to the roles statically.
I also went through this question "Angular 6 Role based Authentication", but again the answer for this only helps with static role assignment.
so when a user clicks on the check box, the user should be assigned access to that particular component. I'm wondering is there a way where am user can manage roles and their permissions dynamically from an UI like Angular?If yes, how do we do it? Or any links that relates this would be of great help !!
i want to provide role based route access e.g there is two types of user 1.Admin and 2.normal user.
if normal user try to access admin pages through url then user will redirects to dashboard page and same case for admin.
This is quite a lot of code you're asking for.
One thing you need to look into is Route Guards which let you protect access to routes based on your own written criteria:
https://angular.io/guide/router#milestone-5-route-guards
You also need to pick a way to manage your roles and users. A popular way for Ionic is to use Firebase:
https://firebase.google.com/
A great tutorial for setting this all up is over at AngularFirebase.com (currently rebranding to Fireship.io).
It's a long tutorial, and you will need to follow an additional tutorial for setting up the login system as well, but it will get you to where you want to be.
Role Based Authorization With Firestore and Angular
I searched a lot about mandatory access control lists and i did not find useful information about how to apply macl in documentum. i need to know the steps and how to configure.
I already had Documentum CS 7.3 with TCS license enabled and i tested it by applying esignature on pdf document
macl allows you to dynamically apply acl to objects depending on specific conditions.
Example 1:
Software developers are assigned read permission on documentation documents
Team Leads are assigned write permission on documentation documents.
Project Managers are assigned delete permission on documentation documents.
Example 2:
while Users are located in US
users are assigned a write permission on documents under US cabinet and read permission on documents under all other cabinets e.g: UK, Egypt, UAE.
If Users logged in from another network location like UK
Users are assigned write permission on documents from UK cabinet and * read permission * on documents under all other cabinets.
I found The answer to my question by using:
the Required Group, and Required Group sets
where you can give some users some permissions and apply it only if they are members of a specific group only.
Required Groups
(Users/Groups must be a member of all listed groups to access this item)
Required Groups List
(Users/Groups must be a member of at least one of the listed groups to access this item)
I found an issue with EMC's documentation documents:
It states that in order to benefit from Trusted Content services Capabilities you must have TCS license installed. but, practically whether you installed the TCS license or not you can create dynamic ACLs and benefit from the group membership restriction. (practically TCS is not required "case was Tested", and there is misleading information about Dynamic ACLs usage and implementation) no scenario is provided
Sorry, but from your question one could assume that there is something called mandatory ACL within Documetnum platform. However there isn't - AFAIK.
There are several ways with which you can dynamically apply ACL or in terminology of Documentnum platform permission set.
Based on repository configurable parameter:
inherit from object type
inherit from user who created object
inherit from parent folder
If this doesn't fits you you can write TBO (Type Based Object) code which acts as trigger and runs your custom logic.
There are other ways to achieve what you want but you need to be more specific about your requirement.
If your client is D2, you can utilize the dynamic permission model based on documents attributes. This way you can achieve what you are asking for.
This question comes from the following post:
OWIN cookie authentication get roles on client side
I've created a separate thread for the question since it is more general than one in the post above.
In short:
Let's say we have a web application with javascript as client side + ASP.NET web api as server side and also an identity server. Only authenticated users can access web api endpoints, some of them accessible only for specific roles of user.
Now the client side of application should show specific items based on what role user is in. For example: user in administrator role can see an extra tab: manage items. There are two approaches to achieve this:
When rendering client side application, one could call an endpoind in web api which would return what roles user have. Based on that result, show/hide items in html.
When application loads, an endpoint, which returns how the structure should look like (for example: json string) would be returned, and based on that structure client application would be rendered. No show/hide html on client side based on roles in such case.
Now regarding 1st point: some could argue that there is a security leak, since malicious user can modify html to see elements that he is not supposed to see. But in this case he will not see any content from database and will not be able to load/update it since he will not be authorized to do that based on his role which is checked in server side.
2nd point seems more valid since we keep all identity related information logic on server side. And also all unnecessary content is not in html (while in 1st point it's hidden) - so that leads to better performance? In this case though if for example developing angular application, the json structure of application should include such information as name of angular controller and route for example. Would that not add complexity to developing application?
Assume that the application itself have a lot of roles and a lot of items should be visible/not visible based on these roles.
Pros/cons between 1st and 2nd? Thanks!
I stick always with the first suggested point.
As you mentioned the second choice will add more complexity for developing. For the 1st there is no security leak. If you don't want your users to modify the html and to access forbidden areas in your application simply use ng-if instead of ng-show. If you are not familiar - ng-if will not just hide the content with display: none;. It will completely remove it from the DOM and this leading the user unable to show that content as it is not in the DOM.
Read this for more detailed explanation for ng-if and ng-show: what is the difference between ng-if and ng-show/ng-hide
I usually have an endpoint getting information about the user - including it's role and save that user into a service (factory). This gives me the flexibility to use it everywhere in the application and check if the user has access or not to certain parts of it.
Is it possible to have readonly or hidden contenttypes in Bolt?
For part of the website I'm building I use contenttypes to store information gathered from external sites (via an API), and user input (i.e. comments, replies, etc). The contenttype using the API theoretically should never need updating as the content pulled in is managed on the external site.
So is there a way to make them so they cannot be modified, or better yet not show them in the admin content list at all?
Directly, no.
However what I do is to set the permissions on the 'resource' contenttypes to developer and that will hide them from users without that role.