[normal]J3 ACL & Flexicontent: need help.. or is it a bug?

Hi,

I'm running a big site with a lot of backend users.

Basically I have X categories for X users groups, so the Group A can only manage the Category A, the Group B can only use the Category B and so on...


The problem is when I have a user who should use both categories A & B: assigning this user to both groups makes the permission "subtract" and not "adding" the rights.. so this user can't use the category A and the B, instead of have the rights to use them...

Why? Is it a bug or did i just did the wrong setup?

For example for the Category A that only the Group A is allowed to write/erase/publish/etcetc and I "have to" specify that no other groups can do these things [so I put a "deny" on the other groups].
Combining a user in different groups makes the "deny" have more priority in these.. combinations...

I hope I'm clear... please help!

Hello,
-- yes it is normal
-- but it is not difficult to configure this


Explanation of what is happening:


-- if user belong to user groups
A and B

if you set a category NNN to "Deny" in usergroup A then you cannot allow the user to use it by setting to "ALLOw" in usergroup B





The solution is described in Joomla DOCs for ACL permissions (please read)



Short instructions:
you need to use "Soft DENY"
soft deny is if

-- all parent categories AND COMPONENT are set, the EDIT privelege, to "Inherit"

-- AND Joomla Global permissions, set the "EDIT" privelege, to "Not SET"




1. The above will deny ALL categories to the usergroup
and
2. you can set specific categories to "ALLOW" for a usergroup

thus the a user that belongs to 2 user-groups he can get ALL the allowed categories our of ALL usergroups

Hello

also please use v2.2.1 rc1

I can't really understand where I can do this: "Joomla Global permissions set "EDIT" privelege to "Not SET""

I've always the same 3 options: allow, deny, inherit... :shock:

Reading this : docs.joomla.org/J3.x:Access_Con ... t_Tutorial doesn't solve [for now] my problems...

In Joomla Global permssions only the TOP-most usergroups have "NOT Set"


-- by default TOP most is "public" usergroup , this should have EDIT to be "not SET"

-- and then the children usergroups UP to the desired Groups should have "Inherit" aka --> inherit the "NOT SET" which is SOFT deny

"SOFT deny" is inheriting a "NOT SET"

ok, i saw the only "not set" option is in the public group...

so in this case my groups who are children of "manager" should become children of "public"? ... mmm I need to set all the backend priviledges tooo [admin access etc etc].

is it right?