Userroles

Userroles represent a functional privilege (aka Functional Role) which can be granted to Users directly or indirectly via Groups they are member of. Userroles, and the functional privilege they represent, are global and granted for the duration of a user's logged in session.

Userrole configuration

Userroles are stored in the repository under path /hippo:configuration/hippo:userroles where the name of the userrole node defines the userrole name.

Node type definitions

hipposys:userrole

[hipposys:userrole] > nt:base
- hipposys:system (boolean)
- hipposys:userroles (string) multiple
- hipposys:description (string)

hipposys:userrolefolder

[hipposys:userrolefolder] > nt:base
+ * (hipposys:userrole) = hipposys:userrole

Standard provided userroles naming convention

The standard provided userroles are all named with the following convention:

<prefix>.<feature>.<function> 

For brXM the prefix is always xm.

The standard provided userroles furthermore can be classified in three groups:

1. Userroles representing a privilege required to access a feature within the CMS (aka feature 'toggles') which is independent of or unrelated to specific repository content.
   When these userroles are only used for this purpose, they use the following naming convention: xm.<feature>.user.
   For example xm.cms.user, xm.project.user, etc.
2. Userroles which primarily are (to be) used for repository domain security authorization, meaning they are used to grant repository (data) specific privileges in the context of specific repository content and functionality.
   These userroles use the following naming convention: xm.<feature>.<repository context specific role>.
   For example: xm.content.editor, xm.channel.admin, xm.project.viewer. 
3. Convenient userroles which aggregate (imply) all the userroles needed for the standard provided groups (which thus now by default only are configured with only that corresponding userrole), and can be used as basis for custom groups with the same or further extended (userrole based) privileges, for example for LDAP provided groups or otherwise. 
   These userroles all use the following naming convention: xm.default-user.<group name>.
   For example: xm.default-user.editor, xm.default-user.webmaster, xm-default-user.system-admin.  
   Note the slight deviation for the naming of the xm-default-user.system-admin:  this userrole is actually assigned to the default admin group instead of a (not default provided) system-admin group. This is for legacy and backwards compatibility reasons: the admin group effective means system-admin group.

The default provided userroles listed further below are grouped according to this classification. 

CMS and Console access

Being able to login to the CMS or Console application now (only) requires a user to have a dedicated userrole, either:

• xm.cms.user: for login to the CMS
• xm.console.user: for login to the Console

Note: only regular users are allowed to login through these applications, system users (users with property hipposys:system set to true) are not, even if they have been granted one of the above userroles!

CMS Features access

Which CMS features are available (shown) to a user can be restricted by requiring a specific userrole. All (or most) top-level CMS features are configured themselves in the repository through frontend:plugin nodes, which are loaded for a user at (or after) the login. All left-menu entry CMS features and a few deeper nested features now are restricted by requiring a specific "feature toggle" userrole with a hipposys:userrole property, e.g. like:

/hippo:configuration/hippo:frontend/cms/hippo-channel-manager/channel-manager-perspective:
  jcr:primaryType: frontend:plugin
  frontend:appPath: experience-manager
  hipposys:userrole: xm.channel.user

The following CMS features now require a specific userrole:

• Home: xm.dashboard.user
• Experience Manager: xm.channel.user
• Projects: xm.project.user
• Content: xm.content.user
  • Documents
    • Document Types: xm.system.admin
    • Url Rewriter: xm.urlrewriter.admin (since v14.2) or xm.repository.admin (v14.0-14.1)
• Document search: xm.advanced-search.user
• Insights

  • Content reports: xm.report.user

    The xm.report.user userrole is NOT automatically inherited (implied) by any of the default xm.default-user.* userroles,
    nor granted to any of the default provided groups, because it typically is only used/needed for (more) specific users/groups.
    Therefore the xm.report.user userrole needs to be explicity granted by an implementation project to the desired users/groups!
• Audiences
  • Content audiences: xm.targeting.user
• Setup
  • System: xm.system.user
    • Users: xm.security.viewer
    • Groups: xm.security.viewer
    • Userroles: xm.security.viewer
    • Permissions: xm.security.viewer
    • Replication: xm.security.admin
    • System Information: xm.system.admin
    • System Properties: xm.system.admin
    • Updater Editor: xm.system.admin
  • Form data: xm.form.user

Example userrole configuration

/hippo:configuration:
  /hippo:userroles:
    /xm.content.user:
      jcr:primaryType: hipposys:userrole
      hipposys:system: true
    /xm.content.viewer:
      jcr:primaryType: hipposys:userrole
      hipposys:system: true 
      hipposys:userroles: [ xm.content.user ]
    /my.content.viewer:
      jcr:primaryType: hipposys:userrole
      hipposys:userroles: [ xm.content.viewer ]

Default provided userroles