#537 Remove superuser

[Mark Grimshaw]

As there is little difference between the superadmin and other admins (other than the superadmin can upgrade the WIKINDX), remove the distinction:

• There can be one or more administrators who have identical rights.
• Any administrator account can be deleted but there must always be at least one unblocked administrator account.
• Ensure that an upgrade can only be carried out by one admin at a time.

Mark

[Stéphane Aulery]

Attached files are a test of file locking.

[Mark Grimshaw]

A few further thoughts about this (following past email discussions) as I work on the new \libs\USERACCESS (a centralised place to more easily control user access to viewing and manipulating WIKINDX data).

I suggest that there be a distinction between a superadmin and an admin.

1. A superadmin can do everything.
2. An admin can do everything except configure the fundamental WIKINDX. An admin cannot, for example:
   • run a WIKINDX update
   • configure the WIKINDX through the Admin menu
   • manage WIKINDX components through the Admin menu
   • see points 2 and 3 below

There should be the option for the original superadmin to anoint other superadmins (what happens, in a large organisation, if the original superadmin is no longer available or wishes to step back from such duties and hand the mantle on to another while still using the WIKINDX?). One can always edit the database directly and change the userId of a user, but such direct manipulation should be discouraged.: the userId is used to tie, for example, the creation of resources to a user. Thus a number of database tables would also need to be manipulated. One can always change WIKINDX_SUPERADMIN_ID to another userId, but keeping this system means that there can only ever be one superadmin user (not wise for a large organisation where people come and go).

I propose then that:

1. a new column be introduced in the users database: 'usersSuper' is set to 1 if the user is a superadmin (for this person, 'usersAdmin' will also be set to 1). It is this new column that should be checked in order to determine superadmin status and set the session setup_Superadmin.
2. only a superadmin can anoint or depose another superadmin in the user administration panel.
3. a normal admin can only add normal users.

To make a slight distinction in USERACCESS between the types of admin we already have, and while we discuss this further,, I have already introduced the session variable 'setup_Admin' when a user logs on. The superadmin whose userId matches WIKINDX_SUPERADMIN_ID will have this variable set in addition to 'setup_Superadmin;' a normal admin will only have 'setup_Admin' set.

Thoughts?

Mark

[Stéphane Aulery]

Hi Mark,

I will think about your suggestion during the week.

Regards,