Account Manager

Contents

2. Account manager overview
    2.1 Users: introduction
    2.2 Groups: introduction

3. Users
    3.1 Add a new User
    3.2 Edit: User properties, access permissions, Group/Capacity memberships
        3.2.1 Basic: Edit User username (Full Name)
        3.2.2 Groups/Capacities
            3.2.2.1 Add a User to a Group/Capacity
            3.2.2.2 Remove a User from a Group/Capacity
            3.2.2.3 Change a User's Capacity in a Group
        3.2.3 Intranet
        3.2.4 Administrator permissions: username (Full Name)
        3.2.5 Page Manager
            3.2.5.1 Table: Roles and permissions
            3.2.5.1 Edit User username (Full Name)
    3.3 Delete a User account

4. Groups and Capacities
    4.1 Add a new Group
    4.2 Edit: Group properties, Capacities, add Users to Capacities
        4.2.1 Basic properties
        4.2.2 Capacities 1-8
    4.3 Add a User to a Group/Capacity
    4.4 Delete a Group

5. Skins
    5.1 Base Skin
    5.2 Big Skin
    5.3 Braille Skin
    5.4 Low vision Skin
    5.5 Text Only Skin

6. Concluding remarks

1. Introduction

In Website@School, we have tried to make account management as simple as possible by implementing a refined Role Based Access Control (RBAC) philosophy for Users and Groups. However this simplicity has one weakness; it is easy to make administrative errors. For example, by accidentally checking one box in a User account, you can incorrectly give that User full access to everything on the web site. So special care must be exercised when managing User accounts!

1.1 Features

• Users: Add, edit or delete User accounts and their properties: username, Password, full name, e-mail address, active/inactive, redirection (after logging out), language selection, visibility mode, editor selection, data folder, and various other permissions.
  NOTE: Please read section 2.1 User Manager overview for details on the different types of Users possible.
• Groups: Add, edit or delete Groups and their properties: Group name, description, active/inactive, add one to eight Capacities.
  NOTE: Please read the 2.2 Groups Manager overview for details and examples of Groups and Capacities.
• Capacities: Add, edit or delete up to eight Capacities. A Capacity is a label to which access permissions can be assigned to the different managers, tools, sites, Areas, Sections and pages. Capacity names can be changed as desired. Capacities are discussed in section 2.2 Groups: introduction and in section 3.2 User properties, access permissions, Group/Capacity memberships.
• Labels: nineteen labels to name or rename Capacities according to your preferences. Labels are discussed in section 4.1 Add a group
• Memberships: Assign or revoke a User's membership of a Group/Capacity.
• Intranet: Assign or revoke Intranet privileges to Users or Group/Capacities. Three roles are available. They are discussed in section 3.2.3 Intranet.
• Admin: Assign or revoke Admin privileges to Users or Group/Capacities on: Everything, Start center, Page Manager, File Manager, Module Manager, Account Manager, Configuration Manager, Statistics and various Tools. Admin is discussed in section 3.2.4 Admin.
• Page Manager: Assign or revoke Page Manager privileges to or from Users or Group/Capacities using a fine grained RBAC philosophy. The Page Manager is discussed in section 3.2.5 Page Manager.
• Role Based Access Control: There are seven predefined roles for management of the web site, Areas, Sections and pages. Each role grants access to certain predefined privileges. RBAC is discussed in section 3.2.5 Page Manager.
• Breadcrumb trail: The breadcrumb trail at the top of the workspace on each administrative web page is composed of clickable links to facilitate easy navigation.
• Skins: A number of adjustments (skins) to the appearance and presentation of the management web pages that are specially designed to help blind or visually impaired Users.

1.1.1 For Blind and Visually Impaired Users

Website@School has a selection of special fonts and color contrasted properties which Users can request their web pages to be displayed in. These selectable 'skins' can accommodate screen readers, braille terminals or other visual improvement tools. can accommodate screen readers, braille terminals or other visual improvement tools. The skins can be easily customized further to suit almost every visual impairment.

1.2 Assumptions

1.3 The Exemplum Primary School example

(top)

2. Account Manager overview

accountmanager_account_manager_overview.png

The opening screen is divided into two parts:

• Menu pane: Depending on the task you are performing, clickable links in the Menu give access to several options in the workspace.
  • Users: The clickable link gives access to the Users Manager.
  • Groups: The clickable link gives access to the Groups Manager.
• Workplace pane: Where the options can be edited.

After opening the Account Manager, the Account Manager overview shows a summary of the total active and inactive Users and Groups.

2.1 Users: introduction

1. Regular visitors to a web site (Area) with no account to log in anywhere on the web site.
2. Users with an account having permission to read only the Private Area(s) (i.e.Intranet(s)).
3. Users with an account that permits them to perform management tasks in Website@School.

NOTE: Regular visitors (1) are just visitors, having no access at all.
Users with Intranet access (2) can log in to the web site using http://exemplum.eu/index.php.
Users (3) with enough permissions to do management tasks can log in via the management login dialogue using http://exemplum.eu/admin.php.

A User with only Intranet read permission who tries to log in using the suffix admin.php, is allowed to log in, but receives the Access denied dialogue:

accountmanager_account_manager_access_not_valid.png

The User can now either:

• Select the public Area and access the permitted Intranet(s) via the 'Select Area' dropdown menu (a successful login has already been done), or
• Attempt another login using a valid username with the correct permissions. This is done via the login dialogue.

NOTE: Newly created Users, whose access permissions were not set, receive the same Access denied message.

Logging in can be done by adding index.php and admin.php suffixes to the web site URL. When switching from viewing the web site to the management function or vice versa, the User does not have to log in a second time. When logging out of the web site, the User is also automatically logged out of Website@School management function and vice versa.

Clicking the Users link opens the Users dialogue:

accountmanager_account_manager_users.png

Explanation:
Menu: The selected link is underlined.

• All Users (9): Every User always belongs to the All Users Group.
• No group (1): Those Users who do not belong to any other Group (besides the All Users Group), are added to the Group 'No group'. All newly created Users are placed here initially (the default Group). When a User in the No Group is subsequently assigned to a 'real' Group, he is no longer a member of the No Group.
• faculty (3): A User can be a member of more than one Group, for example, Team, Juniors, Seniors or Faculty. And within each of these Groups, the User is assigned a certain Capacity.
• juniors (3): See previous Group.
• et cetera

NOTE: It is also possible to navigate to a User's account if you know to which Group the User belongs.

1. Under All Users,
2. under Faculty as Member,
3. under Juniors as Teacher,
4. under Team as Member.

Users:

• You are here: accounts > users > all Users: The 'breadcrumb trail' links permitting easy navigation.
• Add a User: Clickable link to the Add a new User dialogue. This subject is discussed in section 3.1 Add a new User
• Trashcan icon: Clickable link to delete a User account. This subject is discussed in section 3.3 Delete a User account
• Pencil icon: Clickable link to edit the Basic properties of the User account. This subject is discussed in section 3.2.1 Basic: Edit User username (Full Name).
• Full Name (username): A clickable link also giving access to the Basic properties of the User account.

Notice that Wilhelmina does not belong to any Group/Capacity. She is a member of the No group.

2.2 Groups: introduction

A Group is a collection of Users. Users (or members) of a Group share a single space (called a 'folder' or a 'directory') where files can be stored. The files are used in Sections and pages that the Group has access to.
A Group is always composed of one or more so-called 'Capacities'. A User within a Group is always associated with only one Capacity within that Group. The Capacity is what assigns the privileges to the User, for example to manage (parts of) the Page Manager or the Translate tool.

File Manager example
Group members can easily create links to existing files in the Group storage space from their web pages (via the Insert/Edit button in the (F)CKEditor), provided they have sufficient privileges for the Page Manager. Group members can upload files to this storage space, but only if they have sufficient privileges for the File Manager.

Example:
Andrew Reese and Catherine Hayes are members of the Group 'Seniors' in the 'Pupil' Capacity. Maria Montessori is also a member of the Group 'Seniors' but in the 'Teacher' Capacity. If Maria has access to the File Manager, she can upload files to the storage space of the Group 'Seniors'. If other Group members, like Andrew and Catherine, have access to the Page Manager (but not the File Manager), they can use the files Maria uploaded, but they cannot upload files themselves.

Page Manager example
Assume that Helen Parkhurst (the teacher of the Juniors) initially has no permissions whatsoever. This means that her account hparkh:
- is not associated with any Group/Capacity (Groups),
- has no privileges with any Private Area (Intranet),
- has no administrator privileges (Admin), let alone permissions to manipulate pages (Page Manager).

By associating her account hparkh with the Group Team in the Member-capacity, she inherits all permissions associated with the combination Team/Member. These permissions could include read access to the Private Area containing the Team Intranet.

If subsequently she is also associated with the Group Juniors in the Teacher-Capacity, she enjoys all privileges associated with the Teacher-Capacity of the Juniors-Group too. These privileges could include access to the File Manager and access to the Page Manager (say as Areamaster) limited to the (protected) Juniors Intranet.

Her pupils may also be associated with the Group Juniors but in the Pupil-Capacity rather than the Teacher-Capacity. Privileges associated with this Pupil-Capacity could be limited to viewing pages in the protected Juniors-Area, whereas the Teacher-Capacity would allow for adding to and editing pages in that (protected) Area.

The bottom line is that the total permissions for Helen Parkhurst consist of the combination of:
- those of her User account hparkh itself (no permissions), and
- Team/Member (Team Intranet), and
- Juniors/Teacher (File Manager, Page Manager for Juniors Intranet).

To expand on the above example: When Helen becomes Teacher of the Seniors next year, it is very easy to end her membership of the Juniors Private Area, make her a member of the Private Area of the Seniors and give the Teacher capacity of the Juniors to the her replacement teacher Mary Astell.

About the relationship between Users, Groups and Capacities:

1. A User can be given zero, one or more privileges. For example the privilege to edit a certain page.
2. A User can be a member of zero, one or more Groups with certain authority, i.e. Capacity.
3. Each Group consists of one or more parts (subGroups) called Capacities. When a User is made member of a Group, the User inherits only one of the Capacities existing in that Group.
4. A Group/Capacity combination can be assigned zero, one or more privileges, for example, the privilege to manage a certain Section.

The table below shows the relationships between the properties of Users, Groups and Capacities. Some properties (among others: data directory, active) belong to Group while others (permissions for Intranet, Admin, etc.) belong to Capacity.

To summarize:
A Group is a collection of Users. A User can only be associated with a Group via a single Capacity. A Capacity consists of a set of permissions. Each User within a Group can have only one Capacity in that Group. A User can be a member of more than one Group with different Capacities in each Group.

NOTE: Capacity names can be changed. For example, if your institution does not use terms like 'Principal', 'Teachers' and 'Pupils' but prefers to use 'Manager', 'Facilitator' and 'End Users', the label names can be easily changed. See chapter Tools, section 3.5 Small language adaptations.

accountmanager_account_manager_groups.png

Explanation:
Menu:

• Users: Discussed earlier, see above.
• Groups: The selected link is underlined.

Groups:

• You are here: accounts > groups: breadcrumb trail links permit easy navigation.
• Add a Group: Clickable link to the Add a new Group dialogue. This subject is discussed in section 4.1 Add a new Group.
• Trashcan icon: Clickable link to delete a Group. This subject is discussed in section 4.5 Delete a Group.
• Pencil icon: Clickable link to edit the Basic properties of the Group. This subject is discussed in section 4.1.1 Edit a Group.
• Group name: A clickable link also giving access to the Basic properties of the Group.
• (Capacity 1, Capacity 2, Capacity n): Each Capacity name is a clickable link allowing the privileges associated with that Capacity to be edited. The Capacity is then displayed with a list of Users having that Capacity. The names of the Users are also clickable links, giving access to the Basic Properties of the User's account.

(top)

3. Users

3.1 Add a new user

accountmanager_account_manager_users.png

To add a new User, click the Add a User link in the Users pane to enter the Add a new User dialogue:

accountmanager_account_manager_users_add_user.png

The Add a new User dialogue is shown.

Explanation:

• Name: Enter the login name for the new User. For example: mastell.

  NOTE: The login name consists of a maximum of sixteen characters: lower case (a-z), digits (0-9), underscore (_) and starts with a letter. A username is always unique.

  NOTE: Since the name of the User's Data Folder is derived from the username, the name of the Data Folder cannot be subsequently changed. So it is important to make a good choice here. If you decide to change the username later on, it may become confusing to have the 'old' Data Folder name linked to the 'new' username.

• Password: Website@School does not accept simple passwords like 'helen' or 'maria2'. These simple passwords are easy to guess and using them endangers your complete system and the data. Passwords must have certain properties to make them difficult to guess.
  A Website@School password must:
  • have at least a minimum length of 6 (six) characters,
  • have at least one uppercase character (A-Z).
  • have at least one lowercase character (a-z).
  • have at least one digit (0-9).
  • preferably have special character like: at-sign '@', hash '#', dollar '$', percentage sign '%', caret '^', ampersand '&', asterisk '*', left parenthesis '(', right parenthesis ')', dash '-', underscore '_', plus '+', equals '=', left curly brace '{', right curly brace '}', opening bracket '[', closing bracket ']', semicolon ';', slash '/', dot '.', question mark '?' or exclamation mark '!'.

  It is also a good idea to choose a password of more than six characters long. For example, a good password is 'Mrbh3ws!' (omit the quotes). This password is easy to remember when you know it stands for the sentence: "My red bike has 3 wheels!". But it is difficult to guess when you do not know the original sentence. This sentence trick is an easy way for pupils to create difficult passwords and remember them easily.

  NOTE: When the chosen password does not meet the above requirements, a warning message is issued and another attempt to enter an improved password is given.

• Confirm password: Enter the same password as previously given.
• Full name: The full name of the owner of this account. For example: Mary Astell.
• E-mail: Enter the e-mail address of this User. This e-mail address is used when the User has forgotten his password and is also used for sending alert messages. For example: m.astell@exemplum.eu.
• Active User [  ] Mark this User as active:
  - Active: a User, Group or Area must be active before any files can be served.
  - Inactive: if a User, Group or Area is inactive, it is as if it does not exist. The Rule of Thumb is: everything is public except that which is not public.

  NOTE: 1. In general any file in the data folder of an active User, an active Group or an active public Area can be retrieved by anyone as long as the name of the file is known.
  2. If a User, Group or Area is inactive, no files can be retrieved, even if the name of the file is known. In other words, once a User, Group or Area is made inactive, it appears to a visitor as if the account or the Area, and its files, no longer exists.

  NOTE: The same active/inactive conditions also apply to pages in Areas. Once an Area is made inactive, its pages are no longer viewable. Even if the URL of the page is provided, the page still cannot be retrieved.

• Save, Done, Cancel: Please see Save, Done, Cancel in the Basic procedures for beginners.

accountmanager_account_manager_users_user_added.png

The User is added to the All Users Group (now 10 Users) and the No Group (now 2 Users). The last Group contains the Users who do not (yet) belong to a Group. Adding a User to a Group is discussed in 3.2.2.1 Add a User to a Group/Capacity.

User's access permissions will be discussed in the next section.

3.2 Edit User properties and grant access permissions

• Basic: Here the unique properties belonging to an individual User can be set. See the Edit User username (Full Name) dialogue, described in section 3.2.1 Basic: Edit User username (Full Name).
• Groups: Here the User can be assigned as a member to different Groups. They are set in the Memberships username (Full Name) dialogue, described in section 3.2.2 Groups/capacities.
• Intranet: Here access and permissions to Intranet(s) can be set for the User. They are set in the Intranet access: username (Full Name) dialogue, described in section 3.2.3 Intranet.
• Admin: Access to the different managers, modules and tools can be set for the User. They are set in the Administrator permissions: username (Full Name) dialogue, described in section 3.2.4 Administrator permissions: username (Full Name).
• Page Manager: This link becomes visible when the User is given access to the Page Manager in Admin. The Page Manager gives access to the Areas, Sections and pages for this User and his roles in each category. They are set in the Page Manager permissions: username (Full Name) [nn-nn of nn] dialogue, described in section 3.2.5 Page Manager.

3.2.1 Basic: Edit username (Full Name)

accountmanager_account_manager_edit_user-top.png

accountmanager_account_manager_edit_user-bottom.png

Explanation:

• Name: The login name of the User. A username consists of a maximum of sixteen characters comprising lowercase letters (a-z), digits (0-9), underscore (_) and must start with a letter. A username is unique and can only occur once.

  NOTE: The username can be changed, but the name of its corresponding data folder cannot be changed.

• Password: To renew a password. The old password is not visible for security reasons. A good password must:
  • have at least a minimum length of 6 (six) characters,
  • have at least one uppercase character (A-Z),
  • have at least one lowercase character (a-z),
  • have at least one digit (0-9).
  • preferably have special character like: at-sign '@', hash '#', dollar '$', percentage sign '%', caret '^', ampersand '&', asterisk '*', left parenthesis '(', right parenthesis ')', dash '-', underscore '_', plus '+', equals '=', left curly brace '{', right curly brace '}', opening bracket '[', closing bracket ']', semicolon ';', slash '/', dot '.', question mark '?' or exclamation mark '!'.
• Confirm password: Retype the same password.
• Full name: The full name of the owner of this account. This name can be changed.
• E-mail: Enter the e-mail address of this User. This e-mail address is used to send an email when the password is not known anymore.
• Active User [  ] Mark this User as active:
  - Active: a User, Group or Area must be active before any files can be accessed.
  - Inactive: if a User, Group or Area is inactive, it is as if it does not exist. The Rule of Thumb is everything is public except that which is not defined as public.

  NOTE:
  1. In general, any file in the data folder of an active User, an active Group or an active public Area can be retrieved by anyone provided the name of the file is explicitly specified in the Universal Resource Locator (URL).
  2. If a User, Group or Area is inactive, no files can be retrieved, even if the name of the file is known. In other words, once a User, Group or Area is inactive, it will appear to a visitor as if the account or the Area, along with its files, no longer exists.

  NOTE: The same active/inactive conditions also apply to pages within an Area. Once an Area is inactive, it appears to a visitor as if the pages in that Area no longer exist.

• Redirection (where to go after logout): If this is left blank, the User is redirected to the login dialogue after logging out. If a complete URL is specified, the User is redirected to that location.

  NOTE: This feature can be useful for Users who are only interested in particular Areas, Sections or just a page. After logging out they can thus end on their favorite page, or on a web page of some other unrelated web site. See the Redirect module for details.

• Language: The dropdown menu shows the languages that are available to this User. The name of each language is shown in its own language. When a different language is selected, it becomes available when the User next logs in.

  NOTE: The language used in the login dialogue is defined in the Configuration Manager section 4. Site.

  NOTE: It is also possible to set the language of the login dialogue from the URL with the language=ll option, for example: http://exemplum.eu/admin.php?language=es for Spanish.
  If your web site URL is bookmarked with this option, you can always enter the login dialogue in your preferred language.

• Editor: The dropdown menu gives access to the editors available to this User. Presently two WYSIWYG (What You See Is What You Get) editors and a plain HTML editor are available.
• Skin: The skin defines the 'look and feel' of the management interface. Changing the skin takes effect after a new login. The following skins are available:
  

  accountmanager_account_manager_skins.png

  This feature and its screenshots are discussed further in section 5. Skins.

• Data folder (pathname cannot be changed): The data folder name was derived from the initial username and cannot be changed afterwards.
• Save, Done, Cancel: Please see Save, Done, Cancel in the Basic procedures for beginners.

3.2.2 Groups/Capacities

3.2.2.1 Add a member to a Group/Capacity

accountmanager_account_manager_user_memberships_none.png

In the Menu, the Groups link is underlined. And in the workplace it can be seen that the User is not a member of any Group.
Click Add a Group membership to enter the Add a Group membership to User username: (Full Name) dialogue:

accountmanager_account_manager_user_group_add_membership.png

Mary Astell is a new teacher, so she will be made a member of the Group 'faculty' in her Capacity as Member. Open the dropdown menu and select faculty/Member. Next click [Done] to save the change and return to the list of Memberships username: (Full Name) dialogue:

accountmanager_account_manager_user_group_membership_added.png

The User is now a member of the Group: Group name (Short description of Group) / Capacity

Now check the Intranet permissions of Mary by clicking the Intranet link in the Menu to enter the Intranet access: username(Full Name) dialogue:

accountmanager_account_manager_user_group_member_intranet.png

Observe that in Intranet access: username (Full Name) under Related, Mary is a member of the Group 'faculty' with Capacity Member and has Access permissions to the Exemplum Intranet.

NOTE: If "faculty/Member Access" is not shown, these permissions were not set for that Capacity. The permissions can now be set via: Account Manager > Groups > Group name > Capacity name > Intranet/Admin/Page Manager.

NOTE: Adding a User to a Group/Capacity has the advantages that all permissions required by the User are set in one action. This saves time and prevents errors occurring.

NOTE: Files in a Group directory are publicly accessible when the file and path names are known.

3.2.2.2 To remove a User from a Group/Capacity

accountmanager_account_manager_user_group_membership_take_away.png

In the Menu column, the Groups link is underlined.

NOTE: There is no warning message issued when a User is removed from a Group after clicking the Trashcan icon. However, it is easy to reassign a User to a Group by repeating the procedure in section 3.2.2.1 Add a member to a Group/Capacity.

To remove a User from membership of a Group, click the Trashcan icon associated with the Group/Capacity.
Only the User's membership of the Group is removed; the Group itself continues to exist.

3.2.2.3 Change a User's Capacity in a Group

3.2.3 Intranet

accountmanager_account_manager_user_intranet.png

In the Menu column, the Intranet link is underlined.

NOTE: Do not accidentally grant a User the Guru permissions to 'All current and future private areas' (Intranets)! It is advisable to grant this permission only to Wilhelmina Bladergroen, the webmaster of the Exemplum Primary School, or to Amelia Cackle.

The Intranet permissions are:

• None: This role has no permissions assigned at all.
• Access: Intranet access granted: private Areas can be visited. This is the normal permission for visitors to the web site who may only read (parts of) an Intranet.
• Guru: Everything: this role provides all possible permissions, perhaps even more.

3.2.4 Administrator permissions: username (Full Name)

accountmanager_account_manager_user_admin_administrator_permissions.png

In the Menu column, the Admin link is underlined.

Explanation:

• Guru (All permissions): This is the most powerful permission possible. If this permission is set, it is not necessary to set any other permission in the list; the User is automatically assigned to all permissions.
• Startcenter (Basic administrator): This permission is required to access the Website@School Startcenter Welcome page. This permission is necessary for all underlying permissions. Removing this permission can be a useful feature for temporarily blocking the selected permissions for that User.
• Manipulate pages and Sections (Page Manager): Gives access to the Page Manager where Sections and pages are managed.
  When this option is selected, the Page Manager link is added to the User's Menu.
• Upload files (File Manager): Gives access to the File Manager according to the permissions set in the Page Manager.
• Module administration (Module Manager): Allows the site wide settings of modules to be changed.
• Users and Groups (Account Manager): Gives access to the Account Manager [1].
• Site configuration and Area manager (Configuration Manager): Gives access to the Configuration Manager.
• Pageviews and performance (Statistics): Gives access to the Statistics.
• Tools (Translations): Gives access to the Translate Tool.
• Tools (Backups): Allows the User to create backups.
• Tools (Log Viewer): Allows the User to view the log files.
• Tool (Update Manager): Gives access to the Update Manager.
• Tool (Sessions): Gives access to the Session Manager.
• [Save], [Done], [Cancel]: Please refer to section 2.3.3 [Save], [Done] and [Cancel] in the chapter Basic procedures for beginners for more information.

Notice that Mary Astell has the Roles: Basic administrator, Page Manager and File Manager.

3.2.5 Page Manager

3.2.5.1 Table: Roles and permissions

1. --: Null. This role is equivalent to no permissions at all. It is the default setting except for the person who originally installed Website@School, who has Guru (all) permissions.
2. Contentmaster: Only page content can be modified.
3. Pagemaster: Page properties and page content can be modified.
4. Sectionmaster: Section properties can be modified and subSections and pages can be added.
5. Areamaster: Area properties can be modified and top-level[*] Sections and pages can be added.
6. Sitemaster: Site properties can be modified and Areas, Sections and pages can be added.
7. Guru: Everything: this role provides all possible permissions, perhaps even more.

[*] Top-level, in this case, means that the Sections and pages are visible in the menu bar of a theme. The possibility to add a top-level Section or page influences the number of items in the main menu of an Area (the horizontal top row in themes like Frugal or Rosalina). A page in a Section, or a Section in a Section, is not considered a top-level page or Section.

Example:
A pupil is given the Contentmaster permission and his teacher gets the Pagemaster permission. This combination enables the pupil to create only the content on an invisible or inactive page given to him by the teacher. The teacher can modify the content, make the page visible or set embargo/expiry dates with the Pagemaster permissions.

When the Page Manager was selected in the previous section '3.2.4 Administrator permissions: username (Full Name)', the Page Manager link is added to the Menu of the Edit User username (Full Name) dialogue:

accountmanager_account_manager_edit_user_pagemanager_added-top.png

In the Menu, select Page Manager to open the Page Manager permissions: username (Full Name) [nn-nn of nn] dialogue:

accountmanager_account_manager_edit_user_pagemanager.png

3.2.5.2 Edit User username (Full Name)

Now we can grant the Page Manager permissions to Mary Astell. She is a new User to Website@School so we grant her Guru permissions in the sandbox, i.e. the Exemplum inactive Area. This Area is segregated and no one can see what takes place in this enclosed area.

accountmanager_account_manager_edit_pagemanager_expanded.png

NOTE: Be careful ! Do not accidentally give a User permission to 'All current and future areas'.

Notice the You are here: breadcrumb trail, indicating what web page you are on, and allowing easy navigation to the higher pages. The Page Manager permissions: username (Full Name) [nn-nn of nn] can sometimes indicate that the list of allowable Intranets is longer than shown on this page.
The View: at the bottom of the page allowes easy jumping to other page(s).
Also notice the opened Area 3: Mary Astell has no pages created by her as yet.

Explanation:

• Realm: In the Page Manager, the User permissions for a specific realm, i.e. the Areas, its underlying Sections, subSections and pages can each have a specific Role attached to it.
• Role:
  • --: Null. This role has no permissions at all assigned to it.
  • Contentmaster: Only page content can be modified.
  • Pagemaster: Page properties and page content can be modified.
  • Sectionmaster: Section properties can be modified and subSections and pages can be added.
  • Areamaster: Area properties can be modified and top-level Sections and pages can be added
  • Sitemaster: Site properties can be modified and Areas, Sections and pages can be added.
  • Guru: Everything: this role provides all possible permissions, perhaps even more.

    NOTE: Remember the ascending permissions table that was shown earlier.

• Save, Done, Cancel: Please see Save, Done, Cancel in the Basic procedures for beginners.
• View: By clicking on Previous 1 Next All, you can navigate through the list of Areas, Sections and pages.

3.3 Delete a User account

accountmanager_account_manager_users_with_mastell.png

Click on the Trashcan icon to open the Confirm delete of User username (Full Name) dialogue:

accountmanager_account_manager_delete_user_account.png

Click [Delete] to delete this User account or [Cancel] to abort the Delete action.

NOTE: By deleting the User account, all ACL's (Access Control Lists), all records from the database belonging to this User and all data associated with this User are deleted.
An access control list (ACL) is a list of permissions attached to Users, to processes and to operations. Each entry in a typical ACL specifies a subject and an operation. For example, when a teacher leaves the school, his User account is deleted, as well as his membership of the Group team and his access permissions to read certain pages in the Intranet.

NOTE: If all directories, subdirectories and files belonging to a User are to be deleted, all the files in the directories belonging to him must be deleted before deleting his User account. If any direcory is not empty, an error message is displayed (This is a design feature).

accountmanager_account_manager_delete_user_account_error.png

Beware: Deleting files can cause broken links in pages.
NOTE: The empty data directory itself is not deleted automatically.

accountmanager_account_manager_delete_file.png

NOTE:
1. In general any file in the data folder of an active User, an active Group or an active public Area can be retrieved by anyone as long as the name of the file is known.
2. If a User, Group or Area is inactive, no files can be retrieved, even if the name of the file is known. In other words, once a User, Group or Area is made inactive, it appears to a visitor as if the account or the Area or the files do not exist anymore.

NOTE: Bear in mind that everything existing in a public Area is always publicly accessible once a visitor knows the file path to the file. If you need a protected place for files, use an Intranet instead. A Rule of Thumb: everything is publicly accessable except that which is not public.

(top)

4. Groups and Capacities

Here is an example to illustrate the power of the Group/Capacity feature:
Suppose you can grant twenty parents each with permissions to read only the Parents Intranet (Role: Access), together with permissions to do 'everything' (Role: Guru) in just one Section of the Parents Intranet. (This is possible but it entails actions which can be error prone; doing the same mouse clicks repeatedly twenty times.)
It is far easier to create a Group called 'Parents', set the properties of the Capacity once as described above (carefully checking your work!), and make the twenty parents members of the Parents Intranet Group. Using this technique makes it easier to add, change, or remove properties of a Group/Capacity.

To understand the technique we have created two accounts: Mr. W.G. Spencer, father of Herbert Spencer (Junior pupil) and Mrs. A. Hayes-Hall, mother of Catherina Hayes (Senior pupil).

4.1 Add a new Group

accountmanager_account_manager_overview_users_added.png

In the Menu, click the Groups link to enter the Groups dialogue:

accountmanager_account_manager_group_open.png

Clicking the Add a Group link, opens the Add a new Group dialogue.

accountmanager_account_manager_group_add_group-top.png

Explanation:

• Name: Enter the name for the new Group. Example: parents.

  NOTE: The Group name consists of a maximum of sixteen characters: lowercase (a-z), digits (0-9), underscore (_)and starts with a letter. A Group name can only occur once and cannot be changed. The Group name is also used to create the Group data directory.

• Description: A short description of the Group.
• Active Group [  ] Mark this Group as active:
  - Active: A User, Group or Area must be active before any files can be served.
  - Inactive: If a User, Group or Area is inactive, it is as if it does not exist. The Rule of Thumb is: everything is public except that which is not public (See the Notes below).

  NOTE:
  1. In general, any file in the data folder of an active User, an active Group or an active public Area can be retrieved by a visitor as long as the name of the file is known.
  2. If a User, Group or Area is inactive, no files can be retrieved, even if the name of the file is known. In other words, once a User, Group or Area is made inactive, it appears to a visitor as if the account or Area no longer exists, together with the files therein.

  NOTE: The same active/inactive conditions apply to pages in Areas. Once an Area is inactive, it appears to a visitor that an Area or the pages in that Area do not exist anymore.

In the bottom part of the Add a new Group dialogue, the capacities can be selected:

accountmanager_account_manager_group_add_group-bottom.png

Explanation:

• Capacity 1 to 8: A Group can have one or more Capacities assigned to it, with a maximum of eight.
  Use the dropdown menu to select one or more Capacities from the list.
• Labels: Opening the dropdown menu shows the list of nineteen labels (names) that can be given to a Capacity. The list only suggests some names which can be given to the Capacities. The label names can be easily changed later to your institutional preferences. See the Tools chapter, section 3.5 Small language adaptations on how to change the label names.
• Save, Done, Cancel: Please see Save, Done, Cancel in the Basic procedures for beginners.

accountmanager_account_manager_group_added.png

In the list (next to the Trashcan and the edit icons) the name of the new Group and its corresponding Capacities are shown:
Group name (Capacity name 1, Capacity name 2, ..., Capacity name 8).
Both the pencil icon and the Group name take you to the Basic Properties dialogue. The names of the Capacities are direct links to dialogues where permissions can be assigned to that Capacity.

4.2 Edit: Group properties, Capacities, add Users to Capacities

accountmanager_account_manager_edit_group-top.png

accountmanager_account_manager_edit_group-bottom.png

In the Menu column of the web page:

• Basic properties: The basic properties of the Group can be edited in Edit a Group, discussed in 4.2.1 Basic.
• Member: The name is a clickable link to the permissions related to that Capacity, discussed in 4.2.2 Capacities 1-8
• ...
• Capacity 7: see above
• Capacity 8: see above

4.2.1 Basic properties

• Name: A Group name is unique and therefore can only occur once. It also cannot be changed. The Group name is used to create the Group data directory.
• Description: A short description of the Group.
• Active Group [  ] Mark this Group as active:
  - Active: a User, Group or Area must be active before any files can be accessed from it.
  - Inactive: if a User, Group or Area is inactive, it is as if it does not exist. The Rule of Thumb is: everything is public except that which is not public (see Notes below).

  NOTE:
  1. In general, any file in the data folder of an active User, an active Group or an active public Area can be retrieved by anyone as long as the name of the file is known.
  2. If a User, Group or Area is inactive, no files can be retrieved, even if the name of the file is known. In other words, once a User, Group or Area is made inactive, it appears to a visitor as if the account, the Area or its files do not exist anymore.

  NOTE: The same active/inactive conditions also apply to pages in Areas. Once an Area is inactive, it appears to a visitor as if the pages in that Area or the Area itself do not exist anymore.

• Capacity1-8: Capacities can be added or removed.

  NOTE: Once you remove a Capacity from a Group in this Basic Properties dialogue, all Users that were members of the Group in that Capacity are no longer associated with that Group/Capacity.

  NOTE: It is possible to change the label of a Capacity. Use the dropdown menu to change the labels. Observe screenshot accountmanager_account_manager_open.png. Notice that from the first three groups, the two classes have a hierarchy that differs from the 'faculty' group which has a top-down hierarchy. The Teacher must be first in the hierarchy and then the Pupil. Select Teacher for Pupil without saving in Capacity 1. Then change Pupil for teacher in Capacity 2. After completing these actions, save your work.

• Data folder (cannot be changed): Greyed out thus unchangeable.
• Save, Done, Cancel: Please see Save, Done, Cancel in the Basic procedures for beginners.

4.2.2 Capacities 1-8

accountmanager_account_manager_group_capacity_overview.png

• Overview: An overview.
• Intranet: Access permissions for Intranet, discussed in 3.2.3 Intranet
• Admin: Access permissions for Admin, discussed in 3.2.4 Administrator permissions: username (Full Name)
• Page Manager: This link is shown when Admin the Page manager was selected. The Page Manager is discussed in 3.2.5 Page Manager

4.3 Add a User to a Group/Capacity

Summary: go: You are here: accounts &gr; Users > ahayes > groups > Add a Group membership > dropdown menu: parent/Member

accountmanager_account_manager_groups_members_parents.png

4.4 Delete a Group

accountmanager_account_manager_groups_with_parents.png

Click on the Trashcan icon to open the Confirm delete of Group Group name (Short description of the Group) dialogue:

accountmanager_account_manager_delete_group.png

Click [Delete] to delete this Group account or [Cancel] to avoid creating orphaned web pages.

NOTE: By deleting the Group account, all ACL's (Access Control Lists), all records in the database for this Group and all data associated with this Group are deleted. An ACL is a list of permissions attached to Users, to processes and to operations. Each entry in a typical ACL specifies a subject and an operation. For example, when a teacher leaves the school, his User account is deleted, as well as his membership of the Group team and his access permissions to read certain pages in the Intranet.

NOTE: If you want to physically delete all directories, subdirectories and files, do that as a separate action before deleting the User account. Deleting files can cause broken links in web pages. An empty data directory itself is not deleted automatically.

NOTE: Remember that everything that is located in a public Area is publicly accessible once a visitor knows the file path to a file. If you need a protected place for files, use an Intranet. The Rule of Thumb is everything is public except that which is not public.

(top)

5. Skins

NOTE: Here is an interesting feature. After logging in with http://exemplum.eu/admin.php, you can change Skins 'on the fly'. In the browser enter one of the following URL's:

Below are some examples of web pages belonging to the management functions that can be modified to help Users with impaired vision or other visual disabilities.
Skins can be created for almost every form of low vision or color blindness.
NOTE: Skins can only be applied to the management web pages of the product and not to the web pages created by Users and seen by visitors.

5.1 Base Skin

accountmanager_account_manager_skins_base.png

5.2 Big Skin

accountmanager_account_manager_skins_big.png

5.3 Braille Skin

accountmanager_account_manager_skins_braille.png

The Skin for use with braille terminals is designed in such a way that accessing the main functions is achieved with minimal tabbing.

5.4 Low vision Skin

accountmanager_account_manager_skins_lowvision.png

This is a rather artificial example, only to demonstrate the almost endless possibilities of Skins for visually impaired Users.

5.5 Text only Skin

accountmanager_account_manager_skins_textonly.png

This is an example of a management web page without icons.

(top)

6. Concluding remarks

• Take care not to give the Guru permission to the wrong Users.
• Creating Groups/Capacities and making Users members of a Capacity is the easiest way of giving permissions to individual Users.

(top)