Re: [Hypercontent-users] Access Control within HyperContent

[Alex V. <al...@bi...>]

On Nov 8, 2006, at 12:41 AM, tom tom wrote:

> Hi,
> I got CAS + uPortal and HC working fine. Also I wanted
> to introduce a staging area before contents get
> published, due to this reason I had to introduce some
> file system definitions this also working fine. But I
> got some problems/doubts moving forward.
>
> I want to get build (preview), approve, publish thing
> going. Well.... I am not sure my understanding is
> correct. Any how let me put down my questions and
> doubts.
>
> What is the HC workflow is it as follows.
> build -> aprrove -> publish ?

It would be more like

edit -> preview -> approve -> build -> publish

So you may or may not find the build stage necessary.

>
>
> How can we make sure we cant publish anything without
> the approval. How can we enforce this rule.
> How can we set the mail parameters for the approvers
> when there are items which needs to be approved.

You can set up the approval configuration in the approvals workflow  
script at /config/workflow/approvals.xml in the project repository.   
Every project gets its own copy of this, copied from the bootstrap  
when the project repository is first initialized.  Lines 24-29 and  
42-47 configure the recipients, subject and body of the approval  
emails.  You need to configure your SMTP settings in  
hypercontent.properties for the email to work.

In order to enforce approvals, you need to give your authors "write"  
permission but NOT "approve" permission and set up a separate group  
of approvers with "approve" permission.  You also need to make sure  
that each user that needs to receive emails has an email address  
configured in their vcard (accessed by clicking your username in the  
upper right corner while logged in).  You can configure HC to pull  
this information from LDAP in the classpath properties file / 
properties/xml/LDAPtoVCARD.xml.  Set up the connection parameters,  
and map the attributes surrounded with {} in the rest of the XML to  
your LDAP attributes.

>
> What is the URL which needs to be provided for the
> approvers. So that they can see the projects/resources
> which needs to be approved.

The URL is contained within the email, and can also be accessed by  
going to the workflow approvals screen.

>
> In the workflow UI what I can see is build and publish
> activities only, I can't see the approve activity.
> Should I change any configuration change in order to
> get that in the UI.

The approvals screen is only listed when you have some approval  
activities to perform - so once an author submits something for  
approval, an approver will see that option along with build and publish.

>
>
> I have the following groups.xml (in bootstrap
> project), I would like to have 3 distinct
> users(auther_user,approver_user,publisher_user)  one
> doing the authoring, one doing the approving and other
> doing the publishing. Can we something like that?

Yes, this is fine, you just need to add the corresponding permissions  
for each group in permissions.xml.

>
> Should I do any modification to my new project, cause
> I only changed the groups.xml in bootstrap project
> only.
> Only changed I did was in permissions.xml in my
> project allowing read only access to anybody group.
>
> When I try to access middle of HC page as a approver
> it says you do not have rights ..............etc.
>

You will need to give "group:approvers" write and approve  
permissions, and "group:publishers" permission to publish, and  
"groups:authors" permission to write, all in permissions.xml.

Cheers,
	Alex