Managing and Organizing Clarity Users
The primary concern of user management is controlling access to content and platform features. When done right, users are granted access only to the resources and applications necessary for their responsibilities. So far, Clarity’s team members have been created, but their roles and permissions need to be set.
At Clarity, each user has different responsibilities in developing the enterprise website. Here, we’ll take a closer look at the different types of users involved, their roles, the groups they belong to, and the responsibilities they have for the site. But first, let’s review how roles and permissions work.
Understanding Roles and Permissions
In Liferay, permissions are assigned to roles instead of individuals. Each permission grants the ability to perform a specific action and falls into one of two categories: application permissions or resource permissions. Application permissions pertain to different parts of Liferay’s UI (e.g. visibility to certain sections of the applications menu or control panel). On the other hand, resource permissions pertain to the data itself (e.g. read or write privileges for Liferay blogs).
Roles are collections of permissions that you can assign to multiple users. Each role has a specific scope that’s determined by its type: regular, site, organization, asset library, or account. This is because sometimes you don’t want certain permissions to carry across multiple contexts in a Liferay instance.
| Role type | Scope |
|---|---|
| Regular Role | This is the most extensive permission scope, and it spans across the whole portal. |
| Site Role | Permissions are scoped to a particular site. |
| Organization Role | Permissions are scoped to particular organization’s users. |
| Asset Library Role | Permissions are scoped to an asset library for sharing resources |
| Account Role | Permissions are given to users who are a part of an account. |
Liferay provides out-of-the-box roles, but you can create custom roles with your choice of permissions to fit your business needs. Then, multiple roles can be assigned to multiple users.
To learn more about user management in general, see our official documentation.
Organizations
Clarity relies on user groups and roles for a significant portion of their user and permission management. However, Liferay offers Organizations as an additional user management tool. Organizations can be used to model the hierarchy of a company. It is also an important part of managing groups of accounts.
As their business grows and site requirements evolve, Clarity can consider leveraging Liferay organizations in the future.
See official documentation to learn more about organizations.
Accounts
Liferay also offers additional tools around accounts. These can be used to model business relationships to help manage external parties. For example, Liferay accounts can model a business to consumer (B2C) context in which a customer is a single user. Accounts can also model a business to business (B2B) context where a customer represents an external company with multiple users. See official documentation to learn more about accounts.
Structuring Organizations with User Groups
!!! important Key Decision Deciding how to group and assign permissions to users is a key decision point as you build out your enterprise website. In this situation, it’s recommended to use Liferay user groups to model your organization’s structure on the new site.
To increase efficiency, roles can also be assigned to entire user groups. The purpose behind this is to promote reuse and simplify the user management experience.
Let’s take a look at how we could create user groups, roles and permissions for Christian Carter, the marketing specialist, to be able to access and edit relevant content for marketing.
Exercise One: Assigning Permissions to Roles
Throughout this exercise, let’s impersonate Christian Carter to see what the Liferay instance looks like from his point of view as we assign him permissions.
To begin,
Open the Global Menu (
), go to the Control Panel tab, and click Users and Organizations.Click the Actions button (
) for Christian Carter and select Impersonate User.Notice how he does not have access to any applications or resources he needs to access as a marketing specialist (e.g. site menu, asset library, etc.).
Next, let’s assign him some permissions.
Open the Global Menu (
), go to the Control Panel tab, and click Roles.Click the Marketing Specialist role and go to the Define Permissions tab.
In the left menu, go to Applications Menu → Content → Asset Libraries.
Select these permissions and click Save:
Section Permission Application Access in Control Panel Application View Resource > Asset Library Entry View Site and Asset Library Administration Menu In the left menu, go to Site and Asset Library Administration → Content & Data → Documents and Media.
Select these permissions and click Save:
Section Permission General Access in Site and Asset Library Administration General View Resource > Documents View Resource > Document Folder View In the left menu, go to Site and Asset Library Administration → Site Builder → Pages.
Select this permission and click Save
Section Permission Resource > Page Update
Now the marketing specialist role has permissions related to asset libraries and site pages. This is because marketing specialists need access to asset libraries and pages.
Exercise Two: Assigning a User Group to the Role
After setting the permissions for the role, let’s assign a user group to the role. Note that Liferay roles can also be assigned to individual users, but assigning it to user groups promotes reusability and ease of future maintenance.
While editing the Marketing Specialist role, go to the Assignees tab.
Click the User Groups tab.
Click New, select the Marketing user group, and click Add.
Now the role is assigned to the user group. Next, let’s add Christian Carter to the marketing user group.
Open the Global Menu (
), go to the Control Panel tab, and click User Groups.Click the Actions button (
) for the Marketing user group and select Assign Members.Click New, select Christian Carter, and click Add.
Now that Christian Carter is part of the Marketing user group, he has the Marketing Specialist role’s permissions.
Return to the Users and Organizations and impersonate Christian Carter
Notice he now has access to the Site Menu (
) to add and edit site pages. He also has access to the Global Menu () and the Asset Libraries in the Applications tab.
Well done! Now everyone in the marketing user group has the correct permissions on the platform. Any new users who are added to the user group in the future will also inherit the same set of permissions.
Conclusion
Congratulations! You’ve defined role permissions and assigned that role to all users in the Marketing user group. Next, you’ll learn more about permissions and content.
Next Up: Securing Clarity Content