Website@School Users' Guide
Prev Next

Account Manager

Contents

1. Introduction
    1.1 Features
    1.2 Assumptions

2. Account manager overview
    2.1 Users: introduction
    2.2 Groups: introduction

3. Users
    3.1 Add a new user
    3.2 User properties, access permissions, group/capacity memberships
        3.2.1 Basic
        3.2.2 Groups/capacities
            3.2.2.1 Add a user to a group/capacity
            3.2.2.2 Take away a membership from a group/capacity
            3.2.2.3 Change a members capacity in a group
        3.2.3 Intranet
        3.2.4 Admin
        3.2.5 Page Manager
    3.3 Delete a user account

4. Groups and capacities
    4.1 Add a new group
    4.2 Edit a group
        4.2.1 Basic properties
        4.2.2 Capacities 1-8
    4.3 Add a user to a group/capacity
    4.4 Delete a group

5. Concluding remarks

1. Introduction

In a school with so many areas (sites) to manage, with sometimes hundreds of users, from pupils to the governing board, each with differing access permissions in their groups, with users being members of several groups however with different permissions, with a dozen or so modules to manage, on which some have permissions and others have no or partial permissions, account management can be a task you would not wish for you worst enemy.

In Website@School we have tried to make account management as simple as possible, as well as also permitting a refined, role based access control (RBAC) on users and groups. This advantage has its drawback. It's easy to make mistakes. By checking one wrong box you can give a user access to everything. Please take care when managing accounts!

1.1 Features

The features of the Account Manager in no specific order:

1.2 Assumptions

This chapter elaborates on other chapters. We assume you have read and done the General part of the Table of Contents.

(top)

2. Account Manager overview

To enter the Account Manager, please click on its icon [ accounts ] to open the Account Manager dialogue:

[ Account manager, summary ]
accountmanager_account_manager_overview.png

The opening screen is split in two parts:

After opening the Account Manager, the Account Manager overview shows a summary of active, inactive and total number of users and groups.

2.1 Users: introduction

There are three types of users in Website@School:

  1. Regular visitors of the site and areas, having no account to log in anywhere,
  2. users with an account with permissions only to read Private Area(s) (i.e.Intranet(s)) and
  3. users with an account that permits them to perform management tasks in Website@School.

NOTICE:
Regular visitors (1) are just visitors, having no access at all.
Users with Intranet access (2) can login via the site, i.e. via index.php.
Users (3) with enough permissions to do management tasks can login via the login dialogue, i.e. admin.php.

A user with only Intranet read permissions, accidentally trying to log in via admin.php, is logged in, but encounters the Access denied dialogue:

[ Acces denied, select link ]
accountmanager_account_manager_access_not_valid.png

The user can now either:

NOTICE:
Newly created users, whose access permissions are forgotten to be set, receive the same Access denied message. This results in a complaining user.

Logging in can be done via index.php and admin.php. When switching from the site to management or vice versa, the user does not have to login again. When logging out on the site, the user is also logged out in Website@School management and vice versa.

Time to do some real work. Clicking the Users link opens the Users dialogue:

[ Users, list ]
accountmanager_account_manager_users.png

Explanation:
Menu: The selected link is underlined.

Note that the total number of users in all groups (23) far exceeds the number of users (9). A user can be a member of zero, one or more groups. For example, the existing user Helen Parkhurst, login name hparkh can be found as a member in 4 places:
  1. Under All users,
  2. under Faculty as Member,
  3. under Juniors as Teacher,
  4. under Team as Member.
Or, in other words, every user occurs at least twice in this list. Once under All Users and once under No group, or at least once in another group.

For even easier navigation, note that it is also possible to navigate to a user account if you know to which group the user belongs.

Users:

2.2 Groups: introduction

Groups, and the closely related subject Capacities are a rather complex subject. To take full advantage of the nearly endless possibilities of Website@School's Role Based Access Control (RBAC), we strongly advise you to not skip this paragraph in which we give some examples on its possibilities.

A group is a collection of users, also called the members of a group. Members of a group share space (called a 'folder' or a 'directory') where files can be stored, or space like areas, sections and pages where content is stored.
A group is always divided into 1 or more so-called 'capacities'. A user's group membership is always associated with exactly one capacity within that group. The group member's capacity is used to grant privileges, for exampe to manage (parts of) the Page Manager or the Translate tool.

File Manager example
Group members can easily create links to existing files in the group storage space from their web pages (via the Insert/Edit button in the FCK Editor), provided they have sufficient privileges for the Page Manager. Group members can upload files to this storage space, but only if they have sufficient privileges for the File Manager.

Example:
Andrew Reese and Catherine Hayes are members of the group 'Seniors' in the 'Pupil' capacity. Maria Montessori is also a member of the group 'Seniors' but in the 'Teacher' capacity. If Maria has access to the File Manager, she can upload files to the storage space of the group 'Seniors'. If other group members like Andrew and Catherine have access to the Page Manager (but not the File Manager), they can use the files Maria uploaded, but they cannot upload files themselves.

Page Manager example
Assume that Helen Parkhurst (the teacher of the Juniors) initially has no permissions whatsoever. This means that her account hparkh:
- is not associated with any group/capacity (Groups),
- has no privileges with any Private Area (Intranet),
- has no administrator privileges (Admin), let alone permissions to manipulate pages (Page Manager).

By associating her account hparkh with the group Team in the Member-capacity, she inherits all permissions associated with the combination Team/Member. These permissions could include read access to the Private Area containing the Team Intranet.

If subsequently she is also associated with the group Juniors in the Teacher-capacity, she enjoys all privileges associated with the Teacher-capacity of the Juniors-group too. This privileges could include access to the File Manager and access to the Page Manager (say as Areamaster) limited to the (protected) Juniors Intranet.

Her pupils may also be associated with the group Juniors but in the Pupil-capacity rather than the Teacher-capacity. Privileges associated with this Pupil-capacity could be limited to viewing pages in the protected Juniors-area, whereas the Teacher-capacity would allow for adding and editing pages to that (protected) area.

The bottom line is that the combined permissions for Helen Parkhurst consist of the combination of:
- those of the user account hparkh itself (no permissions), and
- Team/Member (Team Intranet), and
- Juniors/Teacher (File Manager, Page Manager for Juniors Intranet).

To expand the above example: When, next year, Helen becomes Teacher for the Seniors, it is very easy to end her membership of the Juniors Private Area, make her a member of the Private Area of the Seniors and give the new teacher Ovide Decroly the Teacher capacity of the Juniors.

About the relationship between users, groups and capacities:

  1. A user can be given zero, one or more privileges. For example the privilege to edit a certain page.
  2. A user can be a member of zero, one or more groups in a certain quality, i.e. capacity.
  3. Each group is constructed out of one or more parts (subgroups) named capacities. The membership of 1 user to a group implies also the connection to exactly 1 of the capacities of that group.
  4. To a group/capacity can be given zero, one or more privileges, for example the privilege to manage a certain section.

To summarize this complex issue in other words:
A group is a collection of capacities. Each capacity consists of a set of certain permissions. Each user belonging to a group, can have one capacity in that group. A user can be a member of more groups, having different privileges in each group.

NOTICE:
Capacity names can be changed to other preferences. Example: If your institution dislikes words like 'Principal', 'Teachers' and 'Pupils' but prefers 'Manager', 'Facilitator' and 'End Users', the label names can be changed. See chapter Tools, paragraph 3.5 Small language adaptations.

[ Groups, list ]
accountmanager_account_manager_groups.png

Explanation:
Menu:

Groups:

(top)

3. Users

In this paragraph we create a user account, grant the user access permissions and make the user a member of an existing group. The creating of new groups is discussed in 4. Groups and capacities

3.1 Add a new user

In the opening screen of the Account Managers Menu, click the Users link to open the Users dialogue:

[ Users, list ]
accountmanager_account_manager_users.png

To add a new user, click in the Users pane the Add a user link to enter the Add a new user dialogue:

[ Add a new user, entry fields ]
accountmanager_account_manager_users_add_user.png

The Add a new user dialogue is shown.

Explanation:

After clicking [Save], the user is added to the list:

[ Users, message= success, list ]
accountmanager_account_manager_users_user_added.png

The user is added to the All users group (now 10 users) and the No group (now 2 users). The last group contains the users that do not (yet) belong to a group. Adding a user to a group is discussed in 3.2.2.1 Add a user to a group/capacity.

In the next paragraph we will discuss the users access permissions.

3.2 Edit user properties and grant access permissions

When a new user is added he has no permissions at all. This is a security feature. The user can, like everyone, visit the Public Areas.
The permissions for a user are set in five places:

3.2.1 Basic

To edit the Basic properties of the user account, click its pencil icon or the user name. This opens the Edit user username (Full Name) dialogue:

[ Edit user username (Full Name), entry fields. Page top ]
[ Edit user username (Full Name), entry fields. Page bottom ]
accountmanager_account_manager_edit_user-top.png
accountmanager_account_manager_edit_user-bottom.png
In the Menu the Basic link is selected (underlined).

Explanation:

After saving your work, you return to the list of Users where the user is added in the form of Full Name (username).

3.2.2 Groups/capacities

In this paragraph we will add the user to an already existing group. The creation and management of Groups is discussed in paragraph 4. Groups.

3.2.2.1 Add a member to a group/capacity

The user can be made member of one or more groups. To add a member to a group, go to the Account Manager overview and in the Menu click the Users link to enter the list of Users dialogue. Select the user by clicking on the pencil icon to enter the Edit user username (Full Name) dialoge.
Next, in the Menu click the Groups link, to enter the Memberships username: (Full Name) dialogue:

[ Memberships username (Full Name) ]
accountmanager_account_manager_user_memberships_none.png

In the Menu the Groups link is underlined. In the workplace can be seen that the user is not a member of any group.
Click Add a group membership to enter the Add a group membership to user username: (Full Name) dialogue:

[ Add a group membership to user username (Full Name), drop down menu: New group/capacity: faculty/Member selected ]
accountmanager_account_manager_user_group_add_membership.png

Ovide Decroly is a new teacher, so we make him a member of the group 'faculty' in his capacity as Member. Open the dropdown menu and select faculty/Member. Next click [Save] to save your work and return to the list of Memberships username: (Full Name) dialogue:

[ Memberships username (Full Name), message= success ]
accountmanager_account_manager_user_group_membership_added.png

The user is now a member of the group:
groupname (Short description of group) / Capacity

Now check Ovide's Intranet permissions by clicking in the Menu the Intranet link to enter the Intranet access: username(Full Name) dialogue:

[ Intranet access: username (Full Name), Related: faculty/Member Access ]
accountmanager_account_manager_user_group_member_intranet.png

Observe that in Intranet access: username (Full Name) under Related Ovide is a member of the group 'faculty' with capacity Member and has Access permissions to the Exemplum Intranet.

NOTICE:
If "faculty/Member Access" is not visible, these permissions were not yet set for that capacity. Please set the permission via: Account Manager > Groups > Group name > Capacity Name > Intranet/Admin/Page Manager.

NOTICE:
Adding a user to a group/capacity has the advantages that in one go all permissions are set. This saves work and prevents errors.

NOTICE:
Files in a group directory are publicly accessible when the file and path names are known.

3.2.2.2 Take away a membership from a group/capacity

To take a way a membership from a group/capacity, go to the Account Manager overview, click the Users link to enter the list of Users dialogue. Select the user by clicking on the pencil icon to enter the Edit user username (Full Name) dialoge. Next, in the Menu click the Groups link, to enter the Memberships username: (Full Name) dialogue:

[ Memberships username (Full Name) ]
accountmanager_account_manager_user_group_membership_take_away.png

In the Menu the Groups link is underlined.

NOTICE:
There is no warning message, the membership of a group is immediately terminated after clicking the Trashcan icon. However, it is easy enough to reinstate the group membership by repeating the procedure in paragraph 3.2.2.1 Add a member to a group/capacity.

To terminate this users membership from a group, click the Trashcan icon associated with the group/capacity.
Only the membership of the group is removed; the group itself remains existent.

3.2.2.3 Change a members capacity in a group

If you need to change a users capacity in a group, first take away his membership from a capacity before giving him another capacity. Remember, a member can only have one capacity in a group.

3.2.3 Intranet

To grant an user access permissions to one or more Intranet(s), click the Intranet link to open the Intranet access: username: (Full Name) dialogue:

[ Intranet access: username (Full Name), dropdown menu: Role: Guru selected ]
accountmanager_account_manager_user_intranet.png

In the Menu, the Intranet link is underlined.

NOTICE:
Take care! Do not accidentaly grant a user Guru permissions to 'All current and future private areas' (Intranets)! It's best to grant this permission only to Wilhelmina Bladergroen, the webmaster of the Exemplum Primary School, or to Amelia Cackle.

The Intranet permissions are:

3.2.4 Admin

A user can be granted permissions to different Website@School management tools. Click the Admin link to open the Administrator permissions username: (Full Name) dialogue:

[ Administrator permissions: username (Full Name). Page top ]
[ Administrator permissions: username (Full Name), checked: Basic administrator, Page Manager, File manager. Page bottom ]
accountmanager_account_manager_user_admin_administrator_permissions-top.png
accountmanager_account_manager_user_admin_administrator_permissions-bottom.png

In the Menu the Admin link is underlined.

Explanation:

[1]
NOTICE:
Checking the Users and Groups (Account Manager) is equivalent to Guru permisions! Because in the Account Manager someone can promote himself (or someone else) to Guru.

Most of the items speak for themselves. Notice that Ovide Decroly has permissions to the Start Center, the Page Manager and Upload Files.

3.2.5 Page Manager

The user's or group/capacity permissions to the Page Manager are set according to Roles. Roles are sets of permissions. Seven Roles are available for managing the site, areas, sections and pages. Below the Roles and their permissions are described in ascending order:
  1. --: Null, nothing: this role corresponds to no permissions at all. This is the default setting except for the person that installed Website@School, who has Guru (all) permissions.
  2. Contentmaster: Only page content can be modified.
  3. Pagemaster: Page properties and page content can be modified.
  4. Sectionmaster: Section properties can be modified and subsections and pages can be added.
  5. Areamaster: Area properties can be modified and top-level sections and pages can be added. Top level, in this case, means the sections and pages visible in the menu bar of a theme. The possibility to add a top-level section or page influences the number of items in the main menu of an area (the horizontal top row in themse like Frugal or Rosalina). A page in a section or a section in a section is not a top-level page or section.
  6. Sitemaster: Site properties can be modified and areas, sections and pages can be added.
  7. Guru: Everything: this role provides all possible permissions, perhaps even more.

The table below shows the permissions associated with the various Roles. Note that the 'Null'-role is left out because this Role never has any permissions at all. Also note that the Guru-role is left out because this Role always has all permissions.

 

  Content-
master 		Page-
master 		Section-
master 		Area-
master 		Site-
master
Content C of page P in section S or area A X X X X X
Page P in section S or area A - X X X X
Section S in area A - - X X X
Area A - - - X X
All current and future areas - - - - X

Legend:
'-' means not allowed,
'X' means allowed.

Example:
A pupil is given the Contentmaster permission and his teacher gets the Pagemaster permission. The combination enables the pupil to only create content on an invisible or inactive page, given to him by the teacher. The teacher can modify the content, make the page visible or set embargo/expiry dates with her Pagemaster permissions.

When, in the previous paragraph 3.2.4 Admin, the Page Manager was selected, the Page Manager link is added to the Menu of the Edit user username (Full Name) dialogue:

[ Edit user username (Full Name), message= success, Page Manager link added ]
accountmanager_account_manager_edit_user_pagemanager_adeed-top.png

In the Menu, select Page Manager to open the Page Manager permissions: username (Full Name) [nn-nn of nn] dialogue:

[ Page M manager permissions: username (Full Name), drop down menus ]
accountmanager_account_manager_edit_user_pagemanager.png

Now we can grant Ovide Decroly Page Manager permissions. He is new to Website@School so we grant him Guru permissions in the sandbox, i.e. the Exemplum inactive Area. No one will see what goes on there.

[ Page Manager permissions: username (Full Name) [nn-nn of nn], drop down menus: Role: Area 3: Guru selected ] accountmanager_account_manager_edit_pagemanager_expanded.png

NOTICE:
TAKE CARE! Do not accidentally give a user permissions to 'All current and future areas'.

Notice the You are here: breadcrumb trail, indicating where you are and facilitating navigation. The Page Manager permissions: username (Full Name) [nn-nn of nn] can indicate that the list of Intranets is longer than shown. The View: at the bottom of the page facilitates easy jumping to other page(s).
Also notice the opened Area 3: Ovide not yet has any pages.

Explanation:

3.3 Delete a user account

To delete a user account, go to the Account Manager, click on the Users link to open the list of Users dialogue:

[ Users, list ]
accountmanager_account_manager_users_with_odecrol.png

Click on the Trashcan icon to open the Confirm delete of user username (Full Name) dialogue:

[ Confirm delete of user username (Full Name) ]
accountmanager_account_manager_delete_user_account.png

Click [Delete] to delete this user account or [Cancel] on second thoughts.

NOTICE:
By deleting the user account, all ACL's (Access Control Lists) all records from the database of this user and all data associated with this user are deleted.
An access control list (ACL) is a list of permissions attached to users, to processes and to operations. Each entry in a typical ACL specifies a subject and an operation. For example, When a teacher leaves the school, his user account is deleted, as well as his membership of the group team and his access permissions to read certain pages in the Intranet.

NOTICE: The users directory and (sub)directories, files and the user directory itself are not deleted. This is a feature to retain eventual links to pages. If you really want to delete all directories, subdirectories and files, you must that before deleting the user account itself. Deleting files can cause broken links. The empty data directory itself is not deleted.

NOTICE:
1. In general any file in the data folder of any active user, any active group or any active public area can be retrieved by anyone as long as the name of the file is known.
2. If a user, group or area is inactive, no files can be retrieved, even if the name of the file is known. In other words: once a user, group or area is inactive, to a visitor it appears that the account or the area no longer exists and that neither the files appear to exist anymore.

NOTICE:
Bear in mind that everything that is in a public area is publicly accessible once a visitor knows the file path to a file. If you need a protected place for files, use an Intranet. Rule of thumb: everything is public except what is not public.

(top)

4. Groups and capacities

When discussing this paragraph we assume you have read paragraph 2. Account Manager overview, in which groups and capacities are explained and examples are given. In paragraph 3. Users, the Groups, Admin and Page Manager were discussed, but now they are treated from a different perspective, i.e. a group as a collection of permissions, given to a user.

Just one example to illustrate the power of the group/capacity feature. You can grant 20 parents each permissions to only read the Parents Intranet (Role: Access) and also grant them permissions to do 'everything' (Role: Guru) in just one section of the Parents Intranet. This is a lot of dumb work and error prone, doing the same mouse clicks 20 times over.
It's much easier to create a group 'Parents', set the capacities once, as described above - carefully check your work!- and make 20 parents member of the Parents Intranet.
It's also easy to change, add to or remove capacities or users from an existing group.

4.1 Add a new group

After clicking the Account Manager icon, you are on the Account Manager overview:

[ Account manager, summary ]
accountmanager_account_manager_overview_user_added.png

In the Menu, click the Groups link to enter the Groups dialogue:

[ Groups, list ]
accountmanager_account_manager_group_open.png

Clicking the Add a group link opens the Add a new group dialogue.

[ Add a group, entry fields, Page top ]
accountmanager_account_manager_group_add_group-top.png

Explanation:

In the bottom part of the Add a new group dialogue the capacities can be selected:

[ Page bottom. Drop down menu: capacity 1: Member selected ]
accountmanager_account_manager_group_add_group-bottom.png

Explanation:

After selecting one or more capacities, click [Save], where after the, group and its capacities are added to the list:

[ Groups, list, message= success ]
accountmanager_account_manager_group_added.png

In the list, next to the Trashcan and the edit icon the name of the new group and the capacities are visible:
groupnname (Capacityname1, Capacityname2, ..., Capacityname8).
Both the pencil icon and the groupname lead to the Basic Properties dialogue. The names of the capacities are direct links to dialogues where permissions can be assigned to that capacity.

4.2 Edit a group

To edit the properties of a group, open the Groups list. Click on the pencil icon or the name of the group to edit the Basic properties in the Edit a group dialogue:

[ Edit a group, entry fields. Page top ]
[ Edit a group, entry fields. Page bottom ]
accountmanager_account_manager_edit_group-top.png
accountmanager_account_manager_edit_group-bottom.png

In the Menu is visible:

4.2.1 Basic properties

Explanation:

4.2.2 Capacities 1-8

Clicking on one of the capacity names in the Menu opens the Overview: groupname - capacity name dialogue:

[ Overview: groupname - Capacity ]
accountmanager_account_manager_group_capacity_overview.png

4.3 Add a user to a group/capacity

This subject is discussed in paragraph 3.2.2.1 Add a user to a group/capacity

4.4 Delete a group

To delete a group, go to the Account Manager, click on the Groups link to open the list of Groups dialogue:

[ Groups, list ]
accountmanager_account_manager_groups_with_parents.png

Click on the Trashcan icon to open the Confirm delete of group groupname (Short description of the group) dialogue:

[ Confirm delete of group groupname (Description) ]
accountmanager_account_manager_delete_group.png

Click [Delete] to delete this group account or [Cancel] to not create orphans.

NOTICE:
By deleting the group account, all ACL's (Access Control Lists) all records from the database of this group and all data associated with this group are deleted.
An access control list (ACL) is a list of permissions attached to users, to processes and to operations. Each entry in a typical ACL specifies a subject and an operation. For example, When a teacher leaves the school, his user account is deleted, as well as his membership of the group team and his access permissions to read certain pages in the Intranet.

NOTICE:
The group directory and (sub)directories, files and the group directory itself are not deleted. This is a feature to retain eventual links to pages. If you really want to delete all directories, subdirectories and files, do that before deleting the user account. Deleting files can cause broken links. The empty data directory itself is not deleted.

NOTICE:
Bear in mind that everything that is in a public area is publicly accessible once a visitor knows the file path to a file. If you need a protected place for files, use an Intranet. Rule of thumb: everything is public except what is not public.

(top)

5. Concluding remarks

Main points in this chapter:

(top)

Prev Home Next
Module manager   Configuration manager

Author: Dirk Schouten <schoutdi (at) knoware (dot )nl>
Last updated: 2012-02-27