2. Account manager overview
2.1 Users: introduction
2.2 Groups: introduction
3. Users
3.1 Add a new user
3.2 User properties, access permissions,
group/capacity memberships
3.2.1 Basic
3.2.2
Groups/capacities
3.2.2.1 Add a
user to a group/capacity
3.2.2.2 Take
away a membership from a group/capacity
3.2.2.3
Change a member's capacity in a group
3.2.3 Intranet
3.2.4 Admin
3.2.5 Page Manager
3.3 Delete a user account
4. Groups and capacities
4.1 Add a new group
4.2 Edit a group
4.2.1 Basic
properties
4.2.2 Capacities 1-8
4.3 Add a user to a group/capacity
4.4 Delete a group
In Website@School we have tried to make account management as simple as possible, as well as permitting a refined, role based access control (RBAC) on users and groups. This advantage has its drawback. It's easy to make mistakes. By checking one wrong box you can give a user access to everything. Please take care when managing accounts!
NOTICE:
Please read paragraph 2.1 User
Manager overview for details on the different types of users.
NOTICE:
Please read the 2.2 Groups Manager
overview for details on- and examples of groups and capacities.
| Group | Members |
| NoGroup | Wilhelmina Bladergroen (wblader) |
| Faculty | Amelia Cackle (acackl) (Principal) Helen Parkhurst (hparkh) (Member) Maria Montessori (mmonte) (Member) |
| Juniors | Georgina King (georgina) (Pupil) Herbert Spencer (herbert) (Pupil) Helen Parkhurst (hparkh) (Teacher) |
| Seniors | Andrew Reese (andrew) (Pupil) Catherine Hayes (catherine) (Pupil) Maria Montessori (mmonte) (Teacher) |
| Team | Amelia Cackle (acackl) (Member) Freddie Frinton (ffrint) (Member) Helen Parkhurst (hparkh) (Member) Maria Montessori (mmonte) (Member) |
![[ Account manager, summary ]](accountmanager/accountmanager_account_manager_overview.png)
The opening screen is split into two parts:
After opening the Account Manager, the Account Manager overview shows a summary of active, inactive and total number of users and groups.
NOTICE:
Regular visitors (1) are just visitors, having no access at all.
Users with Intranet access (2) can log in via the site, i.e. via
index.php.
Users (3) with enough permissions to do management tasks can log in via the
login dialogue, i.e. admin.php.
A user with only Intranet read permissions, accidentally trying
to log in via admin.php, is logged in, but encounters the
Access denied dialogue:
![[ Acces denied, select link ]](accountmanager/accountmanager_account_manager_access_not_valid.png)
The user can now either:
NOTICE:
Newly created users, whose access permissions are forgotten to be set,
receive the same Access denied message. This results in a
complaining user.
Logging in can be done via index.php and
admin.php. When switching from the site to management or vice
versa, the user does not have to log in again. When logging out of the
site, the user is also logged out of Website@School management and vice
versa.
Time to do some real work. Clicking the Users link opens the Users dialogue:
![[ Users, list ]](accountmanager/accountmanager_account_manager_users.png)
Explanation:
Menu: The selected link is underlined.
For even easier navigation, note that it is also possible to navigate to a user account if you know to which group the user belongs.
Users:
A group is a collection of users, also called the members of a group.
Members of a group share space (called a 'folder' or a
'directory') where files can be stored, or space like areas,
sections and pages where content is stored.
A group is always divided into 1 or more so-called 'capacities'. A
user's group membership is always associated with exactly one capacity
within that group. The group member's capacity is used to grant
privileges, for example to manage (parts of) the Page Manager or the
Translate tool.
File Manager example
Group members can easily create links to existing files in the group
storage space from their web pages (via the Insert/Edit button in the FCK
Editor), provided they have sufficient privileges for the Page Manager.
Group members can upload files to this storage space, but only if
they have sufficient privileges for the File Manager.
Example:
Andrew Reese and Catherine Hayes are members of the group 'Seniors'
in the 'Pupil' capacity. Maria Montessori is also a member of the
group 'Seniors' but in the 'Teacher' capacity. If Maria has
access to the File Manager, she can upload files to the storage space of
the group 'Seniors'. If other group members like Andrew and
Catherine have access to the Page Manager (but not the File Manager), they
can use the files Maria uploaded, but they cannot upload files
themselves.
Page Manager example
Assume that Helen Parkhurst (the teacher of the Juniors) initially has no
permissions whatsoever. This means that her account
hparkh:
- is not associated with any group/capacity (Groups),
- has no privileges with any Private Area (Intranet),
- has no administrator privileges (Admin), let alone permissions to
manipulate pages (Page Manager).
By associating her account hparkh with the group Team in
the Member-capacity, she inherits all permissions associated with the
combination Team/Member. These permissions could include read access to the
Private Area containing the Team Intranet.
If subsequently she is also associated with the group Juniors in the Teacher-capacity, she enjoys all privileges associated with the Teacher-capacity of the Juniors-group too. These privileges could include access to the File Manager and access to the Page Manager (say as Areamaster) limited to the (protected) Juniors Intranet.
Her pupils may also be associated with the group Juniors but in the Pupil-capacity rather than the Teacher-capacity. Privileges associated with this Pupil-capacity could be limited to viewing pages in the protected Juniors-area, whereas the Teacher-capacity would allow for adding and editing pages to that (protected) area.
The bottom line is that the combined permissions for Helen Parkhurst
consist of the combination of:
- those of the user account hparkh itself (no permissions),
and
- Team/Member (Team Intranet), and
- Juniors/Teacher (File Manager, Page Manager for Juniors Intranet).
To expand the above example: When, next year, Helen becomes Teacher for the Seniors, it is very easy to end her membership of the Juniors Private Area, make her a member of the Private Area of the Seniors and give the new teacher Ovide Decroly the Teacher capacity of the Juniors.
About the relationship between users, groups and capacities:
To summarize this complex issue in other words:
A group is a collection of capacities. Each capacity consists of a set of
certain permissions. Each user belonging to a group, can have one capacity
in that group. A user can be a member of more groups, having different
privileges in each group.
NOTICE:
Capacity names can be changed to other preferences. Example: If your
institution dislikes words like 'Principal', 'Teachers' and
'Pupils' but prefers 'Manager', 'Facilitator' and
'End Users', the label names can be changed. See chapter Tools, paragraph 3.5 Small language adaptations.
![[ Groups, list ]](accountmanager/accountmanager_account_manager_groups.png)
Explanation:
Menu:
Groups:
![[ Users, list ]](accountmanager/accountmanager_account_manager_users.png)
To add a new user, click the Add a user link in the Users pane to enter the Add a new user dialogue:
![[ Add a new user, entry fields ]](accountmanager/accountmanager_account_manager_users_add_user.png)
The Add a new user dialogue is shown.
Explanation:
NOTICE:
The login name consists of maximum 16 characters: lower case
(a-z), digits (0-9), underscore (_) and starts with a letter. A
username can only occur once.
NOTICE:
Since the name of the user's Data Folder is derived from his
username and the name of the Data Folder cannot be changed afterwards,
it is important to make a good choice here. If you decide to change the
user's username later on, it may be difficult or confusing to have
the 'old' Data Folder name and the 'new' username.
It is also a good idea to choose a password of more than 6
characters long. Here is an example.
A good password is 'Mrbh3ws!' (omit the quotes). This password
is easy to remember when you know it stands for the sentence: "My
red bike has 3 wheels!". However, and that makes it a good
password, it's very difficult to guess when you do not know the
sentence. This sentence trick is an easy way for pupils to create
difficult passwords and remember them.
NOTICE:
When your password does not meet the requirements, you get a warning
message and you can enter an improved password.
NOTICE:
1. In general any file in the data folder of any active user, any
active group or any active public area can be retrieved by
anyone as long as the name of the file is known.
2. If a user, group or area is inactive, no files can be
retrieved, even if the name of the file is known. In other words: once
a user, group or area is inactive, to a visitor it appears that the
account or the area no longer exists and that neither the files appear
to exist anymore.
NOTICE:
The same active/inactive conditions also apply to pages in
areas. Once an area is inactive, to a visitor it appears that the pages
in that area no longer exist. Even if the URL of the page is known, the
page cannot be retrieved.
![[ Users, message= success, list ]](accountmanager/accountmanager_account_manager_users_user_added.png)
The user is added to the All users group (now 10 users) and the No group (now 2 users). The last group contains the users that do not (yet) belong to a group. Adding a user to a group is discussed in 3.2.2.1 Add a user to a group/capacity.
In the next paragraph we will discuss the user's access permissions.
![[ Edit user username (Full Name), entry fields. Page top ]](accountmanager/accountmanager_account_manager_edit_user-top.png)
![[ Edit user username (Full Name), entry fields. Page bottom ]](accountmanager/accountmanager_account_manager_edit_user-bottom.png)
Explanation:
NOTICE:
The username can be changed, but that's not a good idea because the
name of the data folder cannot be changed.
NOTICE:
1. In general, any file in the data folder of any active user, any
active group or any active public area can be retrieved by
anyone as long as the name of the file is known.
2. If a user, group or area is inactive, no files can be
retrieved, even if the name of the file is known. In other words: once
a user, group or area is inactive, to a visitor it appears that the
account or the area no longer exists and that neither the files appear
to exist anymore.
NOTICE:
The same active/inactive conditions also apply to pages in
Areas. Once an Area is inactive, to a visitor it appears that the pages
in that area no longer exist.
NOTICE:
This feature can be useful for users who are only interested in
particular areas, sections or just a page. After logging out they can
thus end on their favorite page, or on the home page or some other
place they prefer.
NOTICE:
The language of the login dialogue is defined in the Configuration Manager section 4. Site.
NOTICE:
It is also possible to set the language of the login dialogue with the
language=ll option, for example:
http://exemplum.eu/admin.php?language=es for Spanish.
If you bookmark this URL, you enter the login dialogue in your
preferred language. This trick can also be used with the redirect
feature, described above.
![[ Dropdown menu skins ]](accountmanager/accountmanager_account_manager_skins.png)
Please take a look at the available skins in paragraph 5. Skins for an overview.
NOTICE:
An interesting feature. After logging in via admin.php, you
can change skins 'on the fly'. In the browser enter one of
the following URL's:
|
After saving your work, you return to the list of Users where the user is added in the form of Full Name (username).
![[ Memberships username (Full Name) ]](accountmanager/accountmanager_account_manager_user_memberships_none.png)
In the Menu the Groups link
is underlined. In the workplace it can be seen that the user is not a
member of any group.
Click Add a group membership to enter the
Add a group membership to user username: (Full
Name) dialogue:
![[ Add a group membership to user username (Full Name), drop down menu: New group/capacity: faculty/Member selected ]](accountmanager/accountmanager_account_manager_user_group_add_membership.png)
Ovide Decroly is a new teacher, so we make him a member of the group 'faculty' in his capacity as Member. Open the dropdown menu and select faculty/Member. Next click [Save] to save your work and return to the list of Memberships username: (Full Name) dialogue:
![[ Memberships username (Full Name), message= success ]](accountmanager/accountmanager_account_manager_user_group_membership_added.png)
The user is now a member of the group:
group name (Short description of group) / Capacity
Now check Ovide's Intranet permissions by clicking in the Menu the Intranet link to enter the Intranet access: username(Full Name) dialogue:
![[ Intranet access: username (Full Name), Related: faculty/Member Access ]](accountmanager/accountmanager_account_manager_user_group_member_intranet.png)
Observe that in Intranet access: username (Full Name) under Related Ovide is a member of the group 'faculty' with capacity Member and has Access permissions to the Exemplum Intranet.
NOTICE:
If "faculty/Member Access" is not visible, these permissions were
not yet set for that capacity. Please set the permission via:
Account Manager > Groups > Group name > Capacity name >
Intranet/Admin/Page Manager.
NOTICE:
Adding a user to a group/capacity has the advantages that all permissions
are set in one go. This saves work and prevents errors.
NOTICE:
Files in a group directory are publicly accessible when the file and path
names are known.
![[ Memberships username (Full Name) ]](accountmanager/accountmanager_account_manager_user_group_membership_take_away.png)
In the Menu the Groups link is underlined.
NOTICE:
There is no warning message, the membership of a group is immediately
terminated after clicking the Trashcan icon. However, it is easy enough to
reinstate the group membership by repeating the procedure in paragraph
3.2.2.1 Add a member
to a group/capacity.
To terminate this user's membership from a group, click the Trashcan
icon associated with the group/capacity.
Only the membership of the group is removed; the group itself
remains to exist.
![[ Intranet access: username (Full Name), dropdown menu: Role: Guru selected ]](accountmanager/accountmanager_account_manager_user_intranet.png)
In the Menu, the Intranet link is underlined.
NOTICE:
Take care! Do not accidentally grant a user Guru permissions to 'All
current and future private areas' (Intranets)! It's best to grant
this permission only to Wilhelmina Bladergroen, the webmaster of the
Exemplum Primary School, or to Amelia Cackle.
The Intranet permissions are:
![[ Administrator permissions: username (Full Name). Page top ]](accountmanager/accountmanager_account_manager_user_admin_administrator_permissions-top.png)
In the Menu the Admin link is underlined.
Explanation:
Most of the items speak for themselves. Notice that Ovide Decroly has permissions to the Start Center, the Page Manager and Upload Files.
The table below shows the permissions associated with the various Roles. Note that the 'Null'-role is left out because this Role never has any permissions at all. Also note that the Guru role is left out because this Role always has all permissions.
| Content- master |
Page- master |
Section- master |
Area- master |
Site- master |
|
|---|---|---|---|---|---|
| Content C of page P in section S or area A | X | X | X | X | X |
| Page P in section S or area A | - | X | X | X | X |
| Section S in area A | - | - | X | X | X |
| Area A | - | - | - | X | X |
| All current and future areas | - | - | - | - | X |
Example:
A pupil is given the Contentmaster permission and his teacher gets the
Pagemaster permission. The combination enables the pupil to only create
content on an invisible or inactive page, given to him by the teacher. The
teacher can modify the content, make the page visible or set embargo/expiry
dates with her Pagemaster permissions.
When, in the previous paragraph 3.2.4 Admin, the Page Manager was selected, the Page Manager link is added to the Menu of the Edit user username (Full Name) dialogue:
![[ Edit user username (Full Name), message= success, Page Manager link added ]](accountmanager/accountmanager_account_manager_edit_user_pagemanager_added-top.png)
In the Menu, select Page Manager to open the Page Manager permissions: username (Full Name) [nn-nn of nn] dialogue:
![[ Page M manager permissions: username (Full Name), drop down menus ]](accountmanager/accountmanager_account_manager_edit_user_pagemanager.png)
Now we can grant Ovide Decroly Page Manager permissions. He is new to Website@School so we grant him Guru permissions in the sandbox, i.e. the Exemplum inactive Area. No one will see what goes on there.
accountmanager_account_manager_edit_pagemanager_expanded.pngNOTICE:
TAKE CARE! Do not accidentally give a user permissions to 'All current
and future areas'.
Notice the You are here: breadcrumb trail, indicating where you
are and facilitating navigation. The Page Manager permissions:
username (Full Name) [nn-nn of nn] can
indicate that the list of Intranets is longer than shown. The
View: at the bottom of the page facilitates easy jumping to other
page(s).
Also notice the opened Area 3: Ovide has no pages yet.
Explanation:
NOTICE:
Please remember the ascending permissions
table earlier discussed.
![[ Users, list ]](accountmanager/accountmanager_account_manager_users_with_odecrol.png)
Click on the Trashcan icon to open the Confirm delete of user username (Full Name) dialogue:
![[ Confirm delete of user username (Full Name) ]](accountmanager/accountmanager_account_manager_delete_user_account.png)
Click [Delete] to delete this user account or [Cancel] on second thought.
NOTICE:
By deleting the user account, all ACL's (Access Control Lists), all
records from the database of this user and all data associated with this
user are deleted.
An access control list (ACL) is a list of permissions attached to users, to
processes and to operations. Each entry in a typical ACL specifies a
subject and an operation. For example, When a teacher leaves the school,
his user account is deleted, as well as his membership of the group team
and his access permissions to read certain pages in the Intranet.
NOTICE: The user's directory and (sub)directories, files and the user directory itself are not deleted. This is a feature to retain any existing links to pages. If you really want to delete all directories, subdirectories and files, you must do that before deleting the user account itself. Deleting files can cause broken links. The empty data directory itself is not deleted.
NOTICE:
1. In general any file in the data folder of any active user, any active
group or any active public area can be retrieved by anyone as long
as the name of the file is known.
2. If a user, group or area is inactive, no files can be
retrieved, even if the name of the file is known. In other words: once a
user, group or area is inactive, to a visitor it appears that the neither
the account or the area nor the files appear to exist anymore.
NOTICE:
Bear in mind that everything that is in a public area is publicly
accessible once a visitor knows the file path to a file. If you need a
protected place for files, use an Intranet. Rule of thumb: everything is
public except that which is not public.
Just one example to illustrate the power of the group/capacity feature.
You can grant 20 parents each permissions to only read the Parents Intranet
(Role: Access) and also grant them permissions to do 'everything'
(Role: Guru) in just one section of the Parents Intranet. This
entails a lot of work which is quite error prone; doing the same mouse
clicks 20 times over.
It's much easier to create a group 'Parents', set the
capacities once, as described above - carefully check your work!- and make
20 parents member of the Parents Intranet.
It's also easy to change, add to or remove capacities or users from an
existing group.
![[ Account manager, summary ]](accountmanager/accountmanager_account_manager_overview_user_added.png)
In the Menu, click the Groups link to enter the Groups dialogue:
![[ Groups, list ]](accountmanager/accountmanager_account_manager_groups.png)
Clicking the Add a group link opens the Add a new group dialogue.
![[ Add a group, entry fields, Page top ]](accountmanager/accountmanager_account_manager_group_add_group-top.png)
Explanation:
NOTICE:
The group name consists of maximum 16 characters: lowercase
(a-z), digits (0-9), underscore (_)and starts with a letter. A group
name can only occur once and cannot be changed. The group name is also
used to create the group data directory.
NOTICE:
1. In general any file in the data folder of any active user, any
active group or any active public area can be retrieved by
anyone as long as the name of the file is known.
2. If a user, group or area is inactive, no files can be
retrieved, even if the name of the file is known. In other words: once
a user, group or area is inactive, to a visitor it appears that the
account or the area no longer exists and that neither the files appear
to exist anymore.
NOTICE:
The same active/inactive conditions apply to pages in areas.
Once an area is inactive, to a visitor it appears that neither the
pages in that area nor the area exists anymore.
![[ Page bottom. Drop down menu: capacity 1: Member selected ]](accountmanager/accountmanager_account_manager_group_add_group-bottom.png)
Explanation:
![[ Groups, list, message= success ]](accountmanager/accountmanager_account_manager_group_added.png)
In the list, next to the Trashcan and the edit icon the name of the new
group and the capacities are visible:
group name (Capacity
name 1, Capacity name 2, ..., Capacity name 8).
Both the pencil icon and the group name lead to the Basic Properties
dialogue. The names of the capacities are direct links to dialogues where
permissions can be assigned to that capacity.
![[ Edit a group, entry fields. Page top ]](accountmanager/accountmanager_account_manager_edit_group-top.png)
![[ Edit a group, entry fields. Page bottom ]](accountmanager/accountmanager_account_manager_edit_group-bottom.png)
In the Menu is visible:
NOTICE:
1. In general any file in the data folder of any active user, any
active group or any active public area can be retrieved by
anyone as long as the name of the file is known.
2. If a user, group or area is inactive, no files can be
retrieved, even if the name of the file is known. In other words: once
a user, group or area is inactive, to a visitor it appears that neither
the account or the area nor the files appear to exist anymore.
NOTICE:
The same active/inactive conditions also apply to pages in
areas. Once an area is inactive, to a visitor it appears that neither
the pages in that area nor the area itself exist anymore.
NOTICE:
Once you remove a capacity from a group in this Basic Properties
dialogue, all users that were members of the group in that capacity are
no longer associated with that group/capacity.
![[ Overview: group name - Capacity ]](accountmanager/accountmanager_account_manager_group_capacity_overview.png)
![[ Groups, list ]](accountmanager/accountmanager_account_manager_groups_with_parents.png)
Click on the Trashcan icon to open the Confirm delete of group group name (Short description of the group) dialogue:
![[ Confirm delete of group name (Description) ]](accountmanager/accountmanager_account_manager_delete_group.png)
Click [Delete] to delete this group account or [Cancel] to avoid creating orphans.
NOTICE:
By deleting the group account, all ACL's (Access Control Lists), all
records from the database of this group and all data associated with this
group are deleted.
An access control list (ACL) is a list of permissions attached to users, to
processes and to operations. Each entry in a typical ACL specifies a
subject and an operation. For example, when a teacher leaves the school,
his user account is deleted, as well as his membership of the group team
and his access permissions to read certain pages in the Intranet.
NOTICE:
The group directory and (sub)directories, files and the group directory
itself are not deleted. This is a feature to retain any existing
links to pages. If you really want to delete all directories,
subdirectories and files, do that before deleting the user
account. Deleting files can cause broken links. The empty data directory
itself is not deleted.
NOTICE:
Bear in mind that everything that is in a public area is publicly
accessible once a visitor knows the file path to a file. If you need a
protected place for files, use an Intranet. Rule of thumb: everything is
public except that which is not public.
![[ Skin: base ]](accountmanager/accountmanager_account_manager_skins_base.png)
![[ Skin: big ]](accountmanager/accountmanager_account_manager_skins_big.png)
![[ Skin: braille ]](accountmanager/accountmanager_account_manager_skins_braille.png)
![[ Skin: lowvision example ]](accountmanager/accountmanager_account_manager_skins_lowvision.png)
![[ Skin: text only ]](accountmanager/accountmanager_account_manager_skins_textonly.png)