How OpenCms Permissions work

Revision as of 17:44, 7 December 2009

How Permissions work

OpenCms Access Control Lists are different from most other Access Control Lists (ACLs). Unlike most ACLs, OpenCms uses a 3 stage active denial ACL. This means there are three states for any given permission level:

• Allow – yes, you have access
• No Permission - Nothing checked (no allow, no deny) – this is a default deny, what we would normally think of as deny. A “soft” deny, by virtue of not specifically being allowed.
• Deny – this is the “hard” deny – it forces itself over all other permissions at all lower levels of the tree, so that even if you go into a subfolder and check “Allow” specifically, Deny will over-rule it.

So what this means is you don’t want a “hard deny” high up in the file tree if you need to over-ride it elsewhere. Instead, you want the “soft deny”, or just no permission.

One thing about OpenCms is that by default, the User group has write permission. In order to change this, you must go up to the site level, (/sites), select your website folder (in this case /sites/yoursite), manually add in the Users group, and set the permission you want. Then you select “Overwrite Inherited” and “Inherit on Subfolders” so that the permissions you chose are the ones inherited throughout the site.

OpenCms also follows the most restrictive rules for a give user. So, even if a person is an Administrator, of they are also a User, and a User has been blocked from publishing, then that person can’t publish, even though they are an Administrator! The solution is that Administrators should not belong to any other groups.

Default Groups

• Guest – view live content only
• Webuser – has a login, but can’t get to the workspace. Used for storing member data and personalization
• The WebUser user has been removed in opencms 7.0.5
• Users – can login to the workspace, and view the Offline (editing) project, as well as the online (live) project. Usually they have the permission to read, write, view, and control (properties of the file).
• Projectmanagers – can do everything the user can, but can also publish files from the Offline project to the Online (live) project
• Administrators – “god”

With respect to rights to individual resource types, only the Administrators group (and those which have it as parent) are able to create and edit JSP pages.

Basic Permissions

You can select any combination of the following permissions, but remember the MOST restrictive permissions always override, if a person is in more than one group with different permissions set.

(These definitions are from the source code)

• READ (r) the right to read the contents of a resource
• WRITE (w) the right to write the contents of a resource
• VIEW (v) the right to see a resource in listings (workplace)
• CONTROL (c) the right to set permissions of a resource
• DIRECT_PUBLISH (d) the right direct publish a resource even without publish project permissions

Exceptions

Michael Moossen from Alkacon wrote on the OpenCms Mailinglist on June 5th 2008:

... this is not a bug, it is the intended behavior. administrators are allowed to do everything, and all permission checks are ignored. this is important also to have in mind, when testing a new feature/configuration...

Additional Information

Michael Moossen from Alkacon on the OpenCms Mailinglist on December 7th 2009:

...
> Is there some kind of double usage of the +c / -c flag?
Yes, it means (almost) always control as in the docs, except in the explorer types where 'c' means create and not control, 
as just explained.
...