User Group Hierarchy and Viewing Levels

[tmichel]

Before I spend a lot of time doing something my own way I wanted to check here first to see if there is an easier way to target specific user groups.

Here is a user group hierarchy I am using:

911TAP
911TAP-United-States
911TAP-Appalachia
911TAP-Kentucky

Here are the Viewing Access Levels which need to mirror the user groups.

911TAP
911TAP-United-States
911TAP-Appalachia
911TAP-Kentucky

The Idea is if 911TAP is selected then only the 911TAP user group would be able to view the content. Of course to make this work, I would have to invert the user group hierarchy like.

911TAP-Kentucky
911TAP-Kentucky-Appalachia
911TAP-Kentucky-United-States
911TAP-Kentucky-Global

Now if I assign the Viewing Access Level 911TAP-Kentucky to user group 911TAP-Kentucky then all the users assigned to any of the children of 911TAP-Kentucky would be able to view the content. similarly if I assign Viewing Access Level to 911TAP-Kentucky-Appalachai then all of the users assigned to any of the children of 911TAP-Kentucky-Appalachai will be able to view be able to view then content but not users assigned to 911TAP-Kentucky. And following on, if I assign Viewing Access Level 911TAP-United-States to 911TAP-Kentucky-United-States then users assigned to 911TAP-Kentucky-United-States and 911TAP-Kentucky-Global would be abler to view the content and lastly if if I assign Viewing Access Level 911TAP-Kentucky-Global to 911TAP, then only users assigned to 911TAP-Kentucky-Global could view the content.

the problem with this is that it is rally complicated and I have to define a gazillion user groups to make this work. I would prefer a system where I have the user group hierearchy structre defined like:

911TAP
911TAP-United-States
911TAP-Appalachia
911TAP-Kentucky

and then if I assign Viewing Access Level 911TAP to user group 911TAP then 911TAP can see every thing in the hierarchy, but anything below tap can't see things designated for 911TAP.

What I want to accomplish is for higher level user groups to be able to see down, but lower level user groups can't see up.

Understand that there are going to be seven regions in the United States and 52 states plus several international regions and their associated provinces. So I need to start out with the simplest configuration possible.

[Webdongle]

The hierarchy of the user groups has nothing to do with what view/access level. User groups inherit Permissions (Login, Create, Edit etc.). User Groups that are not selected in a view/access level will not have viewing access even if their Parent user group does. !!!

You are close but here goes.

Suggest you match the Categories to the view/access levels not the user groups.


User Groups ... hierarchy

911TAP ...... Registered as Parent

911TAP-United-States ...... Registered as Parent

911TAP-Appalachia ...... Registered as Parent

911TAP-Kentucky ...... Registered as Parent


Access/view levels

• 911TAP ... select user group 911TAP and any Editor/Publisher etc. group that you require
• 911TAP-United-States ... select user group 911TAP-United-States and any Editor/Publisher etc. group that you require
• 911TAP-Appalachia ... select user group 911TAP-Appalachia and any Editor/Publisher etc. group that you require
• 911TAP-Kentucky ... select user group 911TAP-Kentucky and any Editor/Publisher etc. group that you require

Categories

911TAP
>911TAP-United-States ... 911TAP as Parent
>911TAP-Appalachia ... 911TAP as Parent
>911TAP-Kentucky ... 911TAP as Parent

-----------------------------------------------------

If you require more specific editing

User Groups ... hierarchy

911TAP ...... Registered as Parent
>911TAP Author ...911TAP as Parent
>>911TAP Editor ... 911TAP Author as Parent
>>>911TAP Publisher ... 911TAP Editor as Parent

911TAP United-States ...... Registered as Parent
>911TAP United-States Author ... 911TAP United-States as Parent
>>911TAP United-States Editor ... 911TAP United-States Author as Parent
>>>911TAP United-States Publisher ... 911TAP United-States Editor as Parent

911TAP Appalachia ...... Registered as Parent
>911TAP Appalachia Author ... 911TAP Appalachia as Parent
>>911TAP Appalachia Editor ... 911TAP Appalachia Author as Parent
>>>911TAP Appalachia Publisher ...911TAP Appalachia Editor as Parent

911TAP Kentucky ...... Registered as Parent
>911TAP Kentucky Author ... 911TAP Kentucky as Parent
>>911TAP Kentucky Editor ... 911TAP Kentucky Author as Parent
>>>911TAP Kentucky Publisher ... 911TAP Kentucky Editor as Parent

Categories

911TAP
>911TAP-United-States ... 911TAP as Parent
>911TAP-Appalachia ... 911TAP as Parent
>911TAP-Kentucky ... 911TAP as Parent


Leave the Global config Permissions as 'Inherited' all the user Groups will inherit Registered Permissions.

Then
In Content >> > Category >>> the category '911TAP'
set the Permissions for '911TAP Author' e.g. Create/Edit Own. '911TAP Editor' and '911TAP Publisher' will inherit those ... just add a few more permissions to 911TAP Editor. '911TAP Publisher' will inherit those then just add more permissions for that user group.

In Content >> > Category >>> the category '911TAP-United-States'
the Permissions for '911TAP Author' etc will be inherited
set the Permissions for '911TAP-United-States Author' e.g. Create/Edit Own. '911TAP-United-States Editor' and '911TAP-United-States Publisher' will inherit those ... just add a few more permissions to '911TAP-United-States Editor'. '911TAP-United-States Publisher' will inherit those then just add more permissions for that user group.



All the categories with 911TAP as Parent will inherit the same permissions for user groups. That takes care of what the User Groups have Permission to Create edit etc.

To control what the User Groups see
In view access level '911TAP' select user groups '911TAP', '911TAP Editor' and '911TAP Publisher'
Similar for view access level '911TAP-United-States' select user groups '911TAP-United-States', '911TAP-United-States Editor' and '911TAP-United-States Publisher'

Suggest work flow

1. Create Parent User Groups (don't touch their default Permissions)
   • Create Child User Groups with correct Parent (don't touch their default Permissions)
2. Create View/Access levels and select appropriate User Groups
3. Create Root Categories and set Permissions for appropriate User Groups
   • Create Child Categories and set Permissions for appropriate User Groups
   • Create Articles
   • Create menu items with appropriate view access level

[tmichel]

I am using K2, do K2 categories accomplish the same thing. I am also doing this for JEvents which has it's own Category system, not exactly sure yet what I should target.

I also should clarify the user group hierarchy since the editor stripped the indents I will show it again below.

911TAP
>911TAP-United-States
>>911TAP-Appalachia
>>>911TAP-Kentucky

and then the viewing access levels are:

911TAP
911TAP-United-States
911TAP-Appalachia
911TAP-Kentucky

Where, when:
911TAP-Kentucky is selected as the Viewing Access Level, then anyone who is a member of 911TAP, 911TAP-UNited-States, 911TAP-Appalachia, and 911TAP-Kentucky will see the event listed on the Calendar interface. But users who are members of 911TAP-Virginia, 911TAP-California, or 911TAP-California-Nevada-Region, or 911TAP-Canada would not.
911TAP-Appalachia is selected, then everyone that is a member of 911TAP-Appalachia, 911TAP-United-States, and 911TAP would be able to see the event listed on the calendar, but 911TAP-Kentucky wouldn't nor would any users who are members outside of Appalachia and the United States.
911TAP-United-States is selected, then only members of 911TAP and 911TAP-United-States would see the event listed in the calendar.
When 911TAP is selected, then only members of the 911TAP group would see the event listed in the calendar.

The problem I have now is how to make an event visible across many lowest level user groups, I can only select one Viewing Access Level at a time. Let me revioew what you said earlier again and think about how I can mix and match groups and viewing access.

In other words I want to make some events only visible to people that live in Kentucky while others to everyone living in the Appalachia region of the United States and yet others to everyone living in the Untied States. I haven't included Europe and Asia yet but that has already been requested, so perhaps Europe, Asia, Australia, Africa, Canada, Central and South America and Oceania will also be added to this map. When all those groups are included 911TAP will be the parent to all. At other times I want to make an event only visible to a particular group.

In JEvents the Viewing Access Level is selected from a drop down that lists all the Viewing Access Levels, so the restriction would apply on a per event basis. For instance there is a user group called 911TAP-Board with a corresponding Viewing Access Level 911TAP-Board. This will let the Board create Agendas and Minutes that can only be viewed by members that have been assigned to the 911TAP-Board group. But at other times I want events visible to everyone in a particular region.

JEvents also has Categories, so I would want to assign editorial capability based on another set of user groups, i.e. 911TAP-Kentucky-Event-Editor or 911TAP-Appalachia-Event-Manager, etc. and I link to those capabilities in JEvents which has it's own set of permissions.

[Webdongle]

Here are the Viewing Access Levels which need to mirror the user groups.

911TAP
911TAP-United-States
911TAP-Appalachia
911TAP-Kentucky

Where
911TAP sees the whole world
911TAP-United-States sees all of the United States
911TAP-Appalachia sees everything in the Appalachia region of the United States
911TAP-Kentucky only sees what is taking place in Kentucky

Then you put

User Group '911TAP' and all the user groups that have global edit Permissions in all the view access levels
If you have child of '911TAP' you put those in the '1TAP' view access level

User Group '911TAP-United-States' in the '911TAP-United-States' view access level
If you have child of '911TAP-United-States' you put all of those in the '911TAP-United-States' view access level as well

What users see is determined by the user group they are in and which view levels that user group is selected in.

[tmichel]

I edited my previous response, you might want to look at it again. I am starting to get the picture of what it is I am trying to accomplish. Thank so much for your guidance.

[tmichel]

OK, So would I do something like the following

Registered->911TAP
Registered->911TAP->Event-Listing-Agent
Registered->911TAP->Event-Listing-Agent->Event-Listing-Manager
Registered->911TAP->Event-Listing-Agent->Event-Registration-Manager

Registered->911TAP-United-States
Registered->911TAP-United-States->Event-Listing-Agent
Registered->911TAP-United-States->Event-Listing-Agent->Event-Listing-Manager
Registered->911TAP-United-States->Event-Listing-Agent->Event-Registration-Manager

or

Registered->911TAP->911TAP-United-States
Registered->911TAP->911TAP-United-States->Event-Listing-Agent
Registered->911TAP->911TAP-United-States->Event-Listing-Agent->Event-Listing-Manager
Registered->911TAP->911TAP-United-States->Event-Listing-Agent->Event-Registration-Manager

[Webdongle]

Yep if those were user groups and

'911TAP' didn't have Permissions altered
>>>>>>>'Event-Listing-Agent' has Create/Edit Own added to Permissions in the '911TAP' (Joomla) Category
>>>>>>>>>>>>>>>> 'Event-Listing-Manager'. has Edit/Delete added to Permissions in the '911TAP' (Joomla) Category

Of course you can only have one 'Event-Listing-Agent' and one 'Event-Listing-Manager' ... therefore '911TAP Event-Listing-Agent' would be a better user group name. That way you could have 'another name Event-Listing-Agent' etc user group.

Editing user group Permissions at Category level means that (users in the) user groups are not able to create/edit etc. other Categories. Also the type of Permissions added (to the Permissions the child Inherits) depends on your requirements.

Once you have your User Groups (with their Hierarchy) set up and the Categories set up with the correct Permissions you can set up the View Access Levels. Match the View Access Levels to the Categories ... select the user groups for the access level to match the Category.
i.e. '911TAP' Category will have the Permissions for 'Event-Listing-Agent' and 'Event-Listing-Manager' edited ... so they need to be selected in the '911TAP' Access View Level. (They need to be allowed to View it to exercise their Permissions !). Don't forget to select '911TAP' user group as well

When you create a menu item (with a menu item type of a 3rd party extension) set it to the appropriate View Access Level. e.g. '911TAP'. User Groups '911TAP', '911TAP Event-Listing-Agent' and '911TAP Event-Listing-Manager' will then all be able to View the page of the 3rd party extension. Depending on the 3rd party extension the '911TAP Event-Listing-Agent' and '911TAP Event-Listing-Manager' may or may not have the Create/Edit etc. Permissions.

Some 3rd party extensions honour the Joomla User Group Permissions ... others default all Joomla User Groups as view only and need to be told the Permissions for the User Groups.


Remember

User Groups Inherit Permissions of their Parent ... so when you create a second Child set it's Parent to that of the first Child not the top Parent. That way you only have to add next needed Permission.

Child Categories Inherit the User Group Permissions of their Parent ... so it is important to work out the areas of your site first.

Suggested work flow
Get pen and paper
Write vertical list of Categories
Write a horizontal list of user groups
In the intersections of the two write down the Permissions for the user groups.

Create the User Groups
Create the Categories and set the User Group Permissions per Category
Create the View Access Levels to match the Categories and select (in each View Access Level) the User Groups of the Category that relates to the View Access Level.

[tmichel]

Thanks you ever so much. I will go through the mental process of imagining the Categories, User Groups and the Permissions each needs and then create the viewing access levels to correspond with the categories.

This will probably take a day or so, so I will get back to you as I run into specific problems.

I was actually thinking of only about assigning viewing access permissions to these groups and then designating someone else to actually create the events that would assign the desired viewing access level so that the desired group or collection of groups would be able to view the details of the event.

But now that I think about it I will need local groups in charge of creating local events, regional groups in charge of creating regional events and national groups in charge of creating national events, And each of these will have to be able to set the viewing access level to make the event visible to the desired collection of user groups.

[tmichel]

0

[Webdongle]

Never used K2 but if the Category hierarchy is the same as Joomla then

For Category 9TAP-Global only set the Permissions for the user Group that you want for all its child user Groups.
set
|—|—|—Global-Author
|—|—|—|—Global-Editor
|—|—|—|—|—Global-Publisher
|—|—|—|—|—|—Global-Manager


In the Category '9TAP-United States' only add Permissions for user Groups that you want for all its child groups. (the previous settings will be inherited)
set
|—|—|—United-States-Author
|—|—|—|—United-States-Editor
|—|—|—|—|—United-States-Publisher
|—|—|—|—|—|—United-States-Manager


In the Category 9TAP-US-Cal-Nevada only add Permissions for user Groups that you want for all its child groups. (the previous settings will be inherited)
set
|—|—|—Cal-Nevada-Author
|—|—|—|—Cal-Nevada-Editor
|—|—|—|—|—Cal-Nevada-Publisher
|—|—|—|—|—|—Cal-Nevada-Manager


In the Category 9TAP-US-Cal-Nevada-CA only add Permissions for user Groups that you want for all its child groups. (the settings of 9TAP-Global and '9TAP-United States' will be inherited)
set
|—|—|—US-CA-Author
|—|—|—|—US-CA-Editor
|—|—|—|—|—US-CA-Publisher
|—|—|—|—|—|—US-CA-Manager

That gives the user Groups Permissions to perform the specified actions on what they see

------------------------------------------------------------------

As for viewing/access levels you don't need include/exclude for each. (remember I said in my first reply "match the Categories to the view/access levels")
i.e.

9TAP-Global-Exclude***
9TAP-Global-Include***

should be just

9TAP-Global

With user Groups in it selected
|—|—9TAP-Global
|—|—|—Global-Author
|—|—|—|—Global-Editor
|—|—|—|—|—Global-Publisher
|—|—|—|—|—|—Global-Manager
(and any other user Group you want to see that level e.g. any of the 'Board' user Groups)


9TAP-US-Cal-Nevada-Exclude*
9TAP-US-Cal-Nevada-Include*

should be just

9TAP-US-Cal-Nevada

With user Groups in it selected
|—|—9TAP-Global
|—|—|—Global-Author
|—|—|—|—Global-Editor
|—|—|—|—|—Global-Publisher
|—|—|—|—|—|—Global-Manager

|—|—9TAP-US-Cal-Nevada
|—|—|—Cal-Nevada-Author
|—|—|—|—Cal-Nevada-Editor
|—|—|—|—|—Cal-Nevada-Publisher
|—|—|—|—|—|—Cal-Nevada-Manager
(and any other user Group you want to see that level e.g. any of the 'Board' user Groups)

That allows user Groups 'viewing access' to those levels.

[tmichel]

This is a partial list of the K2 Categories, viewing Access Levels and User Groups that have been created for limiting access to specific categories and to set the permissions for the four levels of users within each region.

What I wanted to know is from this point, what is the proper way to connect the user groups to the K2 categories so that I can assign specific access to people from each of the regions of the United States?

I think I want to connect Categories to a Menu Item and then connect the Access Level to the Menu Item and connect a group of User Groups to an Access Level, for instance I would want to connect 9TAP-Board, Board-Author, Board-Editor, Board-Publisher, Board-Manager usergroups to the 9TAP-Board*** Viewing Access Level, create a Menu Item for 9TAP-Board which would be a List of Articles for the 9TAP-Board category and connect that to 9TAP-Board*** Viewing Access Level. I would then assign permissions to each user groups level where I leave 9TAP-Board as just registered, Board-Author add "Create" and "Edit Own" permissions, Board-Editor add the "Edit" permission, Board-Publisher add the "Edit State" permission, Board-Manager add "Delete" and "Access Administrative Interface" permissions. I will leave "Configure ACL & Options" for Superuser or create a user group called Developers for that purpose.


K2 Categories

9TAP-Board
9TAP-Strategic-Planning
9TAP-Global
. |_ 9TAP-International
. |_ 9TAP-United States
. . |_ 9TAP-US-Cal-Nevada
. . . |_ 9TAP-US-Cal-Nevada-CA
. . . |_ 9TAP-US-Cal-Nevada-NV
. . |_ 9TAP-US-Great-Lakes
. . . |_ 9TAP-US-Great-Lakes-IL
. . . |_ 9TAP-US-Great-Lakes-IN
. . . |_ 9TAP-US-Great-Lakes-OH
. . . |_ 9TAP-US-Great-Lakes-PA
. . |_ 9TAP-US-New-Eng-Mid-Atln
. . . |_ 9TAP-US-New-Eng-Mid-Atln-CT
. . . |_ 9TAP-US-New-Eng-Mid-Atln-MA
. . . |_ 9TAP-US-New-Eng-Mid-Atln-ME
. . . |_ 9TAP-US-New-Eng-Mid-Atln-NH
. . . |_ 9TAP-US-New-Eng-Mid-Atln-NJ
. . . |_ 9TAP-US-New-Eng-Mid-Atln-NY
. . . |_ 9TAP-US-New-Eng-Mid-Atln-RI
. . . |_ 9TAP-US-New-Eng-Mid-Atln-VT

Viewing Access Levels

I use the asterisks to make the higher level access levels stand out.

9TAP-Board***
9TAP-Strategic-Planning***
9TAP-Global***
9TAP-International***
9TAP-United-States**
9TAP-US-Cal-Nevada*
9TAP-US-Cal-Nevada-CA
9TAP-US-Cal-Nevada-NV
9TAP-US-Great-Lakes*
9TAP-US-Great-Lakes-IL
9TAP-US-Great-Lakes-IN
9TAP-US-Great-Lakes-OH
9TAP-US-Great-Lakes-PA
9TAP-US-New-Eng-Mid-Atln*
9TAP-US-New-Eng-Mid-Atln-CT
9TAP-US-New-Eng-Mid-Atln-MA
9TAP-US-New-Eng-Mid-Atln-ME
9TAP-US-New-Eng-Mid-Atln-NH
9TAP-US-New-Eng-Mid-Atln-NJ
9TAP-US-New-Eng-Mid-Atln-NY
9TAP-US-New-Eng-Mid-Atln-RI
9TAP-US-New-Eng-Mid-Atln-VT

Joomla User Groups

|—|—9TAP-Board
|—|—|—Board-Author
|—|—|—|—Board-Editor
|—|—|—|—|—Board-Publisher
|—|—|—|—|—|—Board-Manager
|—|—9TAP-Global
|—|—|—Global-Author
|—|—|—|—Global-Editor
|—|—|—|—|—Global-Publisher
|—|—|—|—|—|—Global-Manager
|—|—9TAP-International
|—|—|—International-Author
|—|—|—|—International-Editor
|—|—|—|—|—International-Publisher
|—|—|—|—|—|—International-Manager
|—|—9TAP-Strategic-Planning
|—|—|—Strategic-Planning-Author
|—|—|—|—Strategic-Planning-Editor
|—|—|—|—|—Strategic-Planning-Publisher
|—|—|—|—|—|—Strategic-Planning-Manager
|—|—9TAP-United-States
|—|—|—United-States-Author
|—|—|—|—United-States-Editor
|—|—|—|—|—United-States-Publisher
|—|—|—|—|—|—United-States-Manager
|—|—9TAP-US-Cal-Nevada
|—|—|—Cal-Nevada-Author
|—|—|—|—Cal-Nevada-Editor
|—|—|—|—|—Cal-Nevada-Publisher
|—|—|—|—|—|—Cal-Nevada-Manager
|—|—9TAP-US-Cal-Nevada-CA
|—|—|—US-CA-Author
|—|—|—|—US-CA-Editor
|—|—|—|—|—US-CA-Publisher
|—|—|—|—|—|—US-CA-Manager
|—|—9TAP-US-Cal-Nevada-NV
|—|—|—US-NV-Author
|—|—|—|—US-NV-Editor
|—|—|—|—|—US-NV-Publisher
|—|—|—|—|—|—US-NV-Manager
|—|—9TAP-US-Great-Lakes
|—|—|—Great-Lakes-Author
|—|—|—|—Great-Lakes-Editor
|—|—|—|—|—Great-Lakes-Publisher
|—|—|—|—|—|—Great-Lakes-Manager
|—|—9TAP-US-Great-Lakes-IL
|—|—|—US-IL-Author
|—|—|—|—US-IL-Editor
|—|—|—|—|—US-IL-Publisher
|—|—|—|—|—|—US-IL-Manager
|—|—9TAP-US-Great-Lakes-IN
|—|—|—US-IN-Author
|—|—|—|—US-IN-Editor
|—|—|—|—|—US-IN-Publisher
|—|—|—|—|—|—US-IN-Manager
|—|—9TAP-US-Great-Lakes-OH
|—|—|—US-OH-Author
|—|—|—|—US-OH-Editor
|—|—|—|—|—US-OH-Publisher
|—|—|—|—|—|—US-OH-Manager
|—|—9TAP-US-Great-Lakes-PA
|—|—|—US-PA-Author
|—|—|—|—US-PA-Editor
|—|—|—|—|—US-PA-Publisher
|—|—|—|—|—|—US-PA-Manager
|—|—9TAP-US-New-Eng-Mid-Atln
|—|—|—New-Eng-Mid-Atln-Author
|—|—|—|—New-Eng-Mid-Atln-Editor
|—|—|—|—|—New-Eng-Mid-Atln-Publisher
|—|—|—|—|—|—New-Eng-Mid-Atln-Manager
|—|—9TAP-US-New-Eng-Mid-Atln-CT
|—|—|—US-CT-Author
|—|—|—|—US-CT-Editor
|—|—|—|—|—US-CT-Publisher
|—|—|—|—|—|—US-CT-Manager
|—|—9TAP-US-New-Eng-Mid-Atln-MA
|—|—|—US-MA-Author
|—|—|—|—US-MA-Editor
|—|—|—|—|—US-MA-Publisher
|—|—|—|—|—|—US-MA-Manager
|—|—9TAP-US-New-Eng-Mid-Atln-ME
|—|—|—US-ME-Author
|—|—|—|—US-ME-Editor
|—|—|—|—|—US-ME-Editor
|—|—|—|—|—US-ME-Publisher
|—|—|—|—|—|—US-ME-Manager
|—|—9TAP-US-New-Eng-Mid-Atln-NH
|—|—|—US-NH-Author
|—|—|—|—US-NH-Editor
|—|—|—|—|—US-NH-Publisher
|—|—|—|—|—|—US-NH-Manager
|—|—9TAP-US-New-Eng-Mid-Atln-NJ
|—|—|—US-NJ-Author
|—|—|—|—US-NJ-Editor
|—|—|—|—|—US-NJ-Publisher
|—|—|—|—|—|—US-NJ-Manager
|—|—9TAP-US-New-Eng-Mid-Atln-NY
|—|—|—US-NY-Author
|—|—|—|—US-NY-Editor
|—|—|—|—|—US-NY-Publisher
|—|—|—|—|—|—US-NY-Manager
|—|—9TAP-US-New-Eng-Mid-Atln-RI
|—|—|—US-RI-Author
|—|—|—|—US-RI-Editor
|—|—|—|—|—US-RI-Publisher
|—|—|—|—|—|—US-RI-Manager
|—|—9TAP-US-New-Eng-Mid-Atln-VT
|—|—|—US-VT-Author
|—|—|—|—US-VT-Editor
|—|—|—|—|—US-VT-Publisher
|—|—|—|—|—|—US-VT-Manager
|—|—9TAP-US-Northwest

[tmichel]

I think I have got it now, I read. I was editing as you were commenting and that led to some confusion.

https://docs.joomla.org/J3.x:Access_Con ... t_Tutorial Helps out.

[Webdongle]

Sorry for the delay but it was early morning here

I think I want to connect Categories to a Menu Item and then connect the Access Level to the Menu Item and connect a group of User Groups to an Access Level, for instance I would want to connect 9TAP-Board, Board-Author, Board-Editor, Board-Publisher, Board-Manager usergroups to the 9TAP-Board*** Viewing Access Level, create a Menu Item for 9TAP-Board which would be a List of Articles for the 9TAP-Board category and connect that to 9TAP-Board*** Viewing Access Level. I would then assign permissions to each user groups level where I leave 9TAP-Board as just registered, Board-Author add "Create" and "Edit Own" permissions, Board-Editor add the "Edit" permission, Board-Publisher add the "Edit State" permission, Board-Manager add "Delete" and "Access Administrative Interface" permissions. I will leave "Configure ACL & Options" for Superuser or create a user group called Developers for that purpose.

Close but not quite

Category 9TAP-Board Permissions
User Group ... 9TAP-Board ... leave everything Inherited
User Group ... Board-Author set allowed for "Create" and "Edit Own" permissions
User Group ... Board-Editor set "Edit" permission ... everything else Inherited
User Group ... Board-Manager set Delete permission ... everything else Inherited
(That allows gives the user Groups Permissions to perform the specified actions on what they see in the front end)



Access to the backend for Board-Manager is
Global config >>> Permissions
User Group ... Board-Manager' set allowed for Administrator Login '

Content Article/Category >>> Options >>> Permissions (and/or K2 component)
User Group ... Board-Manager "Create" "Edit Own" "Edit" and Delete permissions
(the Permissions for Board-Manager user Group in the Category would then be Inherited so would not be changed in Category)

Add user Group Board-Manager to the 'Special' view/access level (admin menu is set 'special' level so any user group in the backend needs to be in that level).

N.B. if user Groups Board-Author, Board-Editor etc refers to groups that edit etc all Categories ... then the 9TAP-Board Category and 9TAP-Board view/access level are not needed. The 9TAP-Board user Groups are selected in all the view/access levels and their Permissions in the top level of all the categories.
----------------------------

Category 9TAP-Global
User Group ... 9TAP-Global ... leave everything Inherited
User Group ... Global-Author set allowed for "Create" and "Edit Own" permissions
User Group ... Global-Editor set "Edit" permission ... everything else Inherited
User Group ... Global-Manager set "Delete" permission ... everything else Inherited
(That allows gives the user Groups Permissions to perform the specified actions on what they see in the front end)

Category 9TAP-United States inherits the user Group Permissions from Category 9TAP-Global
Inherits user Group


Access to the backend for United-States-Manager is
Global config >>> Permissions
User Group ... 'United-States-Manager' set allowed for Administrator Login '

Content Article/Category >>> Options >>> Permissions (and/or K2 component)
User Group ... 'United-States-Manager "Create" "Edit Own" "Edit" and Delete permissions
(the Permissions for Board-Manager user Group in the Category would then be Inherited so would not be changed in Category)

Add user Group United-States-Manager to the 'Special' view/access level (admin menu is set 'special' level so any user group in the backend needs to be in that level).

N.B.
With those settings email notifications will be sent to Super Users to approve. 'Edit state' 'Allowed' allows a user Group to publish/unpublish.

---------------

I use the asterisks to make the higher level access levels stand out

There are NO 'higher level access levels'. view/access levels do NOT have a hierarchy ... the user Groups are selected in the relevant view/access level(s)

i.e.
View/access level 9TAP-Global
Select all user Groups

View/access level 9TAP-United-States
Select all user Group 9TAP-United-States and all child user Groups of it.

---------
Looking at your structure you may need to get pen and paper out.

Write down your Top level Categories and their child Categories
Write down your view/access levels to match the Top level Categories
Write down your First level user Groups to match the view/access levels to match the Top level Categories
Work out which user Groups will be selected in the view/access levels

Write down the Child user Groups
Work out which user Groups are given what Permissions in the Top level Categories

You should then be able to work out what user Groups you will need for editing etc. all Top level Categories.

When you have done all that then you are ready to create
User Groups
Categories
View access levels
If you have already created them then you will need to install a fresh Joomla(or use the backup you made prior to editing the acl) and start again. Otherwise you will get things confused.

[tmichel]

Well there is no way I can install a fresh copy of Joomla, I will just have to figure out how to sort things out.

I do have a two week old copy, but I will loose two weeks worth of new users, but if I have to I have to.

1. There is no hierarchy to the Viewing Access Levels, but as a visual cue to indicate that something like 9TAP-US-WEST* represents a region and not a state or province, I add the asterisk so that it is easily identifiable and stands out from the states in the drop down list; other wise it is hard to find.

2. There is a hierarchy to the K2 categories so that in category view the intros for the sub categories are listed on the resulting page. That is the only reason I created the hierarchy

3. I assigned all child user groups to the corresponding Viewing Access Level because I reasoned that each would need to see the content in order to edit, ie:

|—|—9TAP-US-Appalachia -> 9TAP-US-Appalachia*
|—|—|—Appalachia-Author -> 9TAP-US-Appalachia*
|—|—|—|—Appalachia-Editor -> 9TAP-US-Appalachia*
|—|—|—|—|—Appalachia-Publisher -> 9TAP-US-Appalachia*
|—|—|—|—|—|—Appalachia-Manager -> 9TAP-US-Appalachia*

Are you saying that the Viewing Access Levels should only be applied Appalachia-Manager in this case?

4. I haven't created Menu Items yet as that is the last thing I do in the work flow.

5. I didn't add the "Special" Viewing Access Level to Manager, I would assume that I could add that later.

6. Are you saying that I can't remove "Access Administration Interface" from the Manager Group without creating havoc?

7. 9TAP-Global doesn't mean that this is a user group that has global permissions, this just means that this is a user group to which users will be assigned so that they can receive news that is distributed globally. i.e a user will be assigned to 9TAP-Global, 9TAP-United-States, 9TAP-US-Appalachia, and 9TAP-US-MA. That way an article written for 9TAP-US-MA will only be viewable by people in Massachussets, but an article written for 9TAP-US-Appalachia will be viewable by everyone in the Appalachia region. I want a specific writer to be assigned to write articles for everyone to see and other writers to be able to write articles for their region and still other writers to be restricted to write articles for their particular state.

[Webdongle]

do have a two week old copy, but I will loose two weeks worth of new users

You started adding users before you set up the user groups, Categories, view/access levels and Permissions for a complex acl structure? oops
You didn't make backups at various stages ? oops

I add the asterisk so that it is easily identifiable and stands out from the states in the drop down list

The view/access level names are unique ... you shouldn't need asterisks.

I assigned all child user groups to the corresponding Viewing Access Level because I reasoned that each would need to see the content in order to edit, ie:

|—|—9TAP-US-Appalachia -> 9TAP-US-Appalachia*
|—|—|—Appalachia-Author -> 9TAP-US-Appalachia*
|—|—|—|—Appalachia-Editor -> 9TAP-US-Appalachia*
|—|—|—|—|—Appalachia-Publisher -> 9TAP-US-Appalachia*
|—|—|—|—|—|—Appalachia-Manager -> 9TAP-US-Appalachia*

Are you saying that the Viewing Access Levels should only be applied Appalachia-Manager in this case?

No ... I am saying they need to be selected and any other user groups that you want to see that level.

9TAP-Global doesn't mean that this is a user group that has global permissions, this just means that this is a user group to which users will be assigned so that they can receive news that is distributed globally. i.e a user will be assigned to 9TAP-Global, 9TAP-United-States, 9TAP-US-Appalachia, and 9TAP-US-MA. That way an article written for 9TAP-US-MA will only be viewable by people in Massachussets, but an article written for 9TAP-US-Appalachia will be viewable by everyone in the Appalachia region. I want a specific writer to be assigned to write articles for everyone to see and other writers to be able to write articles for their region and still other writers to be restricted to write articles for their particular state.

You don't need to assign a user to all "9TAP-Global, 9TAP-United-States, 9TAP-US-Appalachia, and 9TAP-US-MA" user groups ... only to one of them. Controlling what a user sees is not done by putting them in several user Groups ... it is done by putting the user in one user Group then selecting that user Group in several view/access levels.

From what you are saying it appears that you don't need any 'Global' user Groups, 'Global' Categories or 'Global' view/access levels.

[tmichel]

You didn't make backups at various stages ? oops

Yes I realize that. I need to do that every morning when I begin work.

You started adding users before you set up the user groups.

The users that have been added previously are added as "Registered" users, no users have been added that have these new user groups selected. This is an existing installation that I am adding the new user groups to.

The view/access level names are unique ... you shouldn't need asterisks.

That isn't obvious when viewing the Viewing Access Levels in a drop down list especially when all the viewing Access Levels begins with 9TAP-US-Appalachia and having the regional group named 9TAP-US-Appalachia* makes it stand out among all the groups like 9TAP-US-Appalachia-DC, 9TAP-US-Appalachia-DE, 9TAP-US-Appalachia-KY, 9TAP-US-Appalachia-MD, 9TAP-US-Appalachia-NC, 9TAP-US-Appalachia-TN, 9TAP-US-Appalachia-VA

You don't need to assign a user to all "9TAP-Global, 9TAP-United-States, 9TAP-US-Appalachia, and 9TAP-US-MA" user groups ... only to one of them. Controlling what a user sees is not done by putting them in several user Groups ... it is done by putting the user in one user Group then selecting that user Group in several view/access levels

I can understand that, so I would select the viewing access level when creating the article regardless of the category selected? I have made the Categories mirror the User Groups which mirrors Viewing Access Levels and Menu Items will mirror those as well when I get this part sorted out.

I have been cutting corners in order to get things done more quickly because I have a lot of people breathing down my neck to abandon the Joomla installation and use SalsaLabs instead. That is something I don't want to do. I guess I just have to keep following a sensible workflow or I risk causing even more time delays.

[Webdongle]

The users that have been added previously are added as "Registered" users, no users have been added that have these new user groups selected. This is an existing installation that I am adding the new user groups to.

http://extensions.joomla.org/extensions ... eba-backup backs up the site into one installable file. As it's an existing site then starting from scratch is not practical so adjusting what you have is ok. Just in case you make a big mistake http://extensions.joomla.org/extensions ... eba-backup backs up the site into one installable file.

so I would select the viewing access level when creating the article regardless of the category selected?

No ... e.g.
With Categories
9TAP-Global
. |_ 9TAP-International
. |_ 9TAP-United States
. . |_ 9TAP-US-Cal-Nevada

An Article in Category with the menu item Access level '9TAP-Global'
(All users will Groups will see it because all user Groups will be selected in the view/access level)

An Article in Category with the menu item Access level '9TAP-US-Cal-Nevada'
(Users in user Groups 9TAP-US-Cal-Nevada, Cal-Nevada-Author, Cal-Nevada-Editor, Cal-Nevada-Publisher and Cal-Nevada-Manager will see it. Therefore a user only needs to be added to one of those user Groups.

If you wanted a user in any of the 9TAP-International user Groups. Instead of adding the user to user Group '9TAP-US-Cal-Nevada'... you would select the 9TAP-International user Groups in the 9TAP-US-Cal-Nevada view/access level.

I have made the Categories mirror the User Groups which mirrors Viewing Access Levels and Menu Items will mirror those as well when I get this part sorted out.

Yes if you have 30 view/access levels then you should have 30 Categories.(that's 30 Categories including the child Categories not just the Parent Categories)

As Category 'Global' refers to the site not a geographical area then 9TAP-International should not be a Child of it.

[tmichel]

Yes if you have 30 view/access levels then you should have 30 Categories.(that's 30 Categories including the child Categories not just the Parent Categories)

As Category 'Global' refers to the site not a geographical area then 9TAP-International should not be a Child of it.

This was probably a bad naming choice on my part. International will expand into Canada and it's provinces and Europe and it's member counties and on around the globe. So 9TAP-Global is the parent of all of these.

I will eventually install a fresh copy of Joomla, create a new modern template that takes advantage of things like the CSS flex property and Multi Column properties and others that make the website more naturally adapt to a wide range of devices from iPhones to 4k displays without having to resort to excessive JavaScript seems like even @media queries may be able to be significantly scaled back. I started to use the flex property at https://www.911truthoutreach.org/911-tr ... gning.html This calendar uses a different set of user groups so that people with specific interests can add their events without being able to access other people's events; works pretty well. Never set Viewing Access Levels for these groups because I used JEvents Categories to select which events get displayed. This also uses something from JEvents that I can only describe as conditional HTML, really neat.

Thanks for your patience with me. I do appreciate your help.

[Webdongle]

You are close to having the acl set to your requirements. And I suspect that by typing out the structure to explain what you want ... has helped you clarify in your own mind what is actually needed.

[tmichel]

Yes it seems when I try to explain to someone I am asking to help me, the process of writing out what I want actually helps me see things more clearly and logically.

I will step back now and read the documentation again, re-read your comments and make a final assault on this.

[Webdongle]

...
I will step back now and read the documentation again, re-read your comments and make a final assault on this.

Hopefully one of my comments will spark that eureka moment.

It may be a good idea at this stage to create a few menu items of various view/access levels and a few test users. Then login the test users into the frontend with different browsers and compare what they can see/do.

[tmichel]

Yeh, I want to review and make whatever changes the need to be made to the permissions before I do that.

I thought of creating separate groups like 9TAP-Global-Coordinators, 9TAP-United-States-Coordinators, etc to allow for private communications between members of this group. I was going to do that through Viewing Access Levels 9TAP-Global-Exclude, 9TAP-United-States-Exclude, etc, but then thought it might be better to have public and private groups instead.

[Webdongle]

Yeh, I want to review and make whatever changes the need to be made to the permissions before I do that

Perhaps creating the test users etc would help you " make whatever changes the need to be made to the permissions" ?

...
I thought of creating separate groups like 9TAP-Global-Coordinators, 9TAP-United-States-Coordinators, etc to allow for private communications between members of this group. I was going to do that through Viewing Access Levels 9TAP-Global-Exclude, 9TAP-United-States-Exclude, etc, ....

Consider a forum for that http://extensions.joomla.org/category/c ... tion/forum

[tmichel]

Looks like Kunena is the best.

Thanks for mentioning this because this is exactly what the heads of this organization is looking for; a way to have dialogue with coordinators at the local level, regional level, national level and eventually the global level.

I am creating a User Group to Viewing Access Level relationship chart so that I am absolutely clear in my mind what it is I want the user experience to be.

I will limit the scope of these user groups to provide editor access to specific categories and user access to specific content.

I would also to be able to limit editors to assign only a limited number of Viewing Access Levels so that only someone with global access could make content available globally while someone with regional access could make content available regionally and locally and someone with local access could only make content available locally.

Like you said I need to be clear on what it is I want to accomplish.

[tmichel]

Is this the way you would set up hte relationship between user groups and viewing access levels so that if the viewing access level is set to 9TAP-Global for a particular document it would be viewable by everyone and editable by the 9TAP-Global Authors Editors Publishers and Managers, and if set to 9TAP-US-Region it would be viewable by everyone in the United States and editable by 9TAP-US-Region Authors, Editors, Publishers and Managers and if set to 9TAP-Aplcia-Region it would be viewable by everyone in Appalachia and editable by 9TAP-Aplcia Authors, Editors, Publisher and Managers and if set to the 9TAP-US-Aplcia-DC region it would be viewable by everyone in Washington DC and editable by 9TAP-Aplcia-DC Authors, Editors, Publishers and Managers.



I would attach the pdf so you could edit the chart and send it back but psd isn't a file type that is accepted here.

[tmichel]

Below is another way of doing it. For the first I would have to subscribe the user to two User Groups, i.e. 9TAP-US-Aplcia-Region and Aplcia-Editor so that they would be able to view both Appalachia Region content and Global, US-Region content. For the mapping below I would only have to subscribe the user to Aplcia-Editor and they would be able to view both Appalachia Region content and Global, US-Region content, but this seems to create a lot more entries in the data base than the first idea where I would subscribe the user to two user groups.

[tmichel]

I should set both Joomla (Global Config Permissions) and the component permissions for each user group that I want to grant particular access to Joomla and the component, correct??

i.e. I would grant 9TAP-Board-Author, Goblal Configurations -> Permissions -> Create and Edit Own, K2 -> Create and Edit Own and JEvents -> Create Events and Edit own events permissions if I want them to be able to create and edit K2 Items and JEvents events for the calendar, correct??

I just found out from K2 that they decided to have their on ACLs. They will use Joomla ACLs in K2 3.0 but until then I have to duplicate all the user groups in K2 and then use their ACL system if I want to have front end editing.

[Webdongle]

i.e. I would grant 9TAP-Board-Author, Goblal Configurations -> Permissions -> Create and Edit Own, K2 -> Create and Edit Own and JEvents -> Create Events and Edit own events permissions if I want them to be able to create and edit K2 Items and JEvents events for the calendar, correct??

Yes correct. You could set the Permissions in Joomla's Global config ... but then users in those User groups would be able to edit anything the User groups had viewing/access to.

I just found out from K2 that they decided to have their on ACLs. They will use Joomla ACLs in K2 3.0 but until then I have to duplicate all the user groups in K2 and then use their ACL system if I want to have front end editing.

That's what I was trying to say earlier

Some 3rd party extensions honour the Joomla User Group Permissions ... others default all Joomla User Groups as view only and need to be told the Permissions for the User Groups.

http://forum.joomla.org/viewtopic.php?f ... 9#p3398268

Do you really need K2 ?


I have a few example files ... if you PM me your email I can send them to you. I did send you a contact email via this forum but not sure if it went in your junk folder ?

[tmichel]

There was a time when K2 provided ACLs and category hierarchies that plain vanilla Joomla didn't provide. They provided a way to specify different column layouts for different pages. They also provide more granular control over content.

But their user groups have no hierarchical structure, no inheritance. It would have been better for them to use Joomla ACLs from Joomla 2.5 onward. Granted Joomla didn't implement ACLs in the absolutely best way, but it is far better than having to create Access Control Lists for every component.

But the direct answer for today is no, I don't necessarily need K2. Just not sure how to convert K2 Items into Joomla Articles without a lot of copy an paste.

I do like the fact that I can have a banner image set for K2 items that is converted into six qualities for the different contexts that the content will be displayed like Full View, Intro View, Item List View, Lightbox View, etc. This is a really nice feature and should actually be built into Joomla.

[tmichel]

I am not allowed PMs at this point, says I am too new to this discussion list. I can friend you, but I can't PM you.