Page History

The These are default permissions set up in Magnolia. You can manage them in the Security app demonstrate how to assign roles, ACLs and web access . The default permissions are just an example how to grant permissions in a typical scenario. These permissions are complemented by configured app access.

The Security app allows you to view a comprehensive list of permissions assigned to any user or group at any point in time. If you need to revert to the default permissions for any reason, you can access them online in the demo site in the Tools tab of the Security app.

The tables below show default permissions, role and group assignments, and configured access permissions.

Table of Contents

Roles

anonymous (role, author instance)

The anonymous role defines the permissions of public, unauthenticated users. Permissions are different on the author and public instances.

Access control lists

...

Web access

...

Access control lists

...

Web access

...

website. You should adapt the permissions to match your own organization. App access is configured separately in the app launcher configuration.

Table of Contents

Roles

anonymous (role, author instance)

The anonymous role defines the permissions of public, unauthenticated users. Permissions are different on the author and public instances.

Access control lists

Workspace	Permission	Scope	Path
Category	Read only	Selected and sub nodes	`/`
DAM	Read only	Sub nodes	`/`
GoogleSitemaps	Read only	Selected and sub nodes	`/`
Marketing-tags	Read only	Selected and sub nodes	`/`
Resources	Read only	Sub nodes	`/`
Website	Deny access	Sub nodes	`/`

Web access

Permission	Path
Deny	`*`
Deny	`/.magnolia*`

Anchor
anonymousrolepublicinstance
anonymousrolepublicinstance
anonymous (role, public instance)

Access control lists

Workspace	Permission	Scope	Path
Category	Read only	Selected and sub nodes	`/`
Dam	Read only	Selected and sub nodes	`/`
GoogleSitemaps	Read only	Selected and sub nodes	`/`
Marketing-tags	Read only	Selected and sub nodes	`/`
Resources	Read only	Sub nodes	`/`
Website	Read only

superuser (role)

The superuser role provides full access to the system. The permissions are the same on author and public instances.

Access control lists

Workspace	Permission	Scope	Path
AdvancedCache	Read/Write	Sub nodes	`/`
Category	Read/Write	Sub nodes	`/`
Config	Read/Write	Sub nodes	`/`
Contacts	Read/Write	Sub nodes	`/`
Dam	Read/Write	Sub nodes	`/`
Dms*	Read/Write	Sub nodes	`/`
Forum	Read/Write	Sub nodes	`/`
GoogleSitemaps	Read/Write	Sub nodes	`/`
Imaging	Read/Write	Sub nodes	`/`
Keystore	Read/Write	Sub nodes	`/`
Marketing-tags	Read/Write	Sub nodes	`/`
Messages	Read/Write	Sub nodes	`/`
Personas	Read/Write	Sub nodes	`/`
Profiles	Read/Write	Sub nodes	`/`
Resources	Read/Write	Sub nodes	`/`
Rss	Read/Write	Sub nodes	`/`
Scripts	Read/Write	Sub nodes	`/`
Segments	Read/Write	Sub nodes	`/`
Stories	Read/Write	Sub nodes	`/`
Tags	Read/Write	Sub nodes	`/`
Tasks	Read/Write	Sub nodes	`/`
Templates	Read/Write	Sub nodes	`/`
Tours	Read/Write	Sub nodes	`/`
Usergroups	Read/Write	Sub nodes	`/`
Userroles	Read/Write	Sub nodes	`/`
Users	Read/Write	Sub nodes	`/`
Website	Read/Write	Sub nodes	`/`
Workflow (EE)	Read/Write	Sub nodes	`/`

Web access

Permission	Path
Get & Post	`*`

Configured access

...

/modules/workflow/messageViews/publish/actions/abort/availability/access/roles

...

Deny	`/.magnolia`
Deny	`/.magnolia/*`
Deny	`/travel/members/protected*`
Deny	`/travel/members/profile-update*`
Deny	`<travel>/members/protected*`
Deny	`<travel>/members/profile-update*`

superuser (role)

The superuser role provides full access to the system. The permissions are the same on author and public instances.

Access control lists

Workspace	Permission	Scope	Path
AdvancedCache	Read/Write	Sub nodes	`/`
Category	Read/Write	Sub nodes	`/`
Config	Read/Write	Sub nodes	`/`
Contacts	Read/Write	Sub nodes	`/`
Dam	Read/Write	Sub nodes	`/`
Dms*	Read/Write	Sub nodes	`/`
Forum	Read/Write	Sub nodes	`/`
GoogleSitemaps	Read/Write	Sub nodes	`/`
Imaging	Read/Write	Sub nodes	`/`
Keystore	Read/Write	Sub nodes	`/`
Marketing-tags	Read/Write	Sub nodes	`/`
Messages	Read/Write	Sub nodes	`/`
Personas	Read/Write	Sub nodes	`/`
Profiles	Read/Write	Sub nodes	`/`
Resources	Read/Write	Sub nodes	`/`
Rss	Read/Write	Sub nodes	`/`
Scripts	Read/Write	Sub nodes	`/`
Segments	Read/Write	Sub nodes	`/`
Stories	Read/Write	Sub nodes	`/`
Tags	Read/Write	Sub nodes	`/`
Tasks	Read/Write	Sub nodes	`/`
Templates	Read/Write	Sub nodes	`/`
Tours	Read/Write	Sub nodes	`/`
Usergroups	Read/Write	Sub nodes	`/`
Userroles	Read/Write	Sub nodes	`/`
Users	Read/Write	Sub nodes	`/`
Website	Read/Write	Sub nodes	`/`
Workflow (EE)	Read/Write	Sub nodes	`/`

travel-demo-base

These are roles specific to the demo websites. The permissions are the same on author and public instances.

Access control lists

...

Read only

...

Selected and sub nodes

...

/tour-types

/destinations

...

travel-demo-admincentral

...

Web access

Permission	Path
Get & Post

*

travel-demo-editor

Access control lists

...

*

Configured access

Applies to	Name	Path
App	Activation	`/modules/activation/apps/activation/permissions/roles`
	Configuration	`/modules/ui-admincentral/apps/configuration/permissions/roles`
	Security	`/modules/security-app/apps/security/permissions/roles`
	Security	`/modules/security-app/dialogs/role/form/tabs/role/fields/jcrName`
	Mail tools	`/modules/mail/apps/mail/permissions/roles`
	Dev tools	`/modules/tools/apps/tools/permissions/roles`
	Backup	`/modules/backup/apps/backup/permissions/roles`
App launcher	Dev group	`/modules/ui-admincentral/config/appLauncherLayout/groups/dev/permissions/roles`
	Tools group	`/modules/ui-admincentral/config/appLauncherLayout/groups/tools/permissions/roles`
Pulse	Abort action	`/modules/workflow/messageViews/publish/actions/abort`

Configured access

Applies to	App	Name	Path
App	Assets		`/modules/dam-app/apps/assets/permissions/roles`
Action	Assets	Activate	/modules/dam-app/apps/assets/subApps/browser/actions/activate `/availability/access/roles`	Action	Pages
	ActivateArchive action	`/modules/pages/apps/pages/subApps/browserworkflow/messageViews/publish/actions/activatearchive/availability/access/roles`

travel-demo-

...

base

These are roles specific to the demo websites. The permissions are the same on author and public instances.

Access control lists

UserrolesSelectedtravel-demo-publisher

Workspace Permission Scope Path Path

travel-demo-admincentral

These are roles specific to the demo-project example websites. The permissions are the same on author and public instances.

Web access

Permission	Path
Get & Post	`*`

travel-demo

...

-editor

Access control lists

Damtour-editor

Workspace Permission Scope Path

editor

Installed by the workflow module (EE). Allows editing content.

Access control lists

...

`editor`
Website	Read/Write	Sub nodes	`/`

Configured access

Applies to	App	Name	Path
App	Assets		`/modules/dam-app/apps/assets/permissions/roles`
Action	Assets	Activate	`/modules/dam-app/apps/assets/subApps/browser/actions/activate/availability/access/roles`

Configured access

Path

Applies to	App	Name
Action	Pages	Activate	`/modules/pages/apps/pages/subApps/browser/actions/activate/availability/access/roles`

publisher

Installed by the workflow module (EE). Allows publishing content.

Access control lists

travel-demo-publisher

Access control lists

/

Workspace	Permission	Scope	Path
Workspace	Permission	Scope	Path
Category	Read only	Sub nodes	`/`
Contacts	Read only	Sub nodes	`/`
Dam	Read only	Sub nodes
Userroles	Read only	Selected	`/travel-demo-publisher`
Website	Read only	Sub nodes	`/`	Workflow	Read/Write	Sub nodes	`/`

Configured access

Path

Applies to	App	Name		App	Name	Path
App	Assets		`/modules/dam-app/apps/assets/permissions/roles`
Action	PagesAssets	Activate	`/modules/pagesdam-app/apps/pagesassets/subApps/browser/actions/activate/availability/access/roles`

workflow-base

Base role allowing users to use the workflow workspace (EE).

Access control lists

...

`/access/roles`
Action	Pages	Activate	`/modules/pages/apps/pages/subApps/browser/actions/activate/availability/access/roles`

travel-demo-tour-editor

...

Access control lists

Workspace Permission Scope Path
ContactCategory
Read
only Sub nodes `/`
Userroles Read only Selected `/contact-base`

imaging-base

Access control lists

Read onlyimaging-base

Workspace	Permission	Scope	Path
/Write Read/Write	Selected and sub nodes Selected and sub nodes	`/tour-types` `/destinations`
Dam	Read/Write	Sub nodes	`/`
Tours	Read/Write
Imaging		Sub nodes	`/`
Userroles	Read only	Selected	`/`

...

travel-demo-tour-editor

editor

Installed by the workflow module (EE). Allows editing content.

Access control lists

ResourcesUserroles only

Workspace	Permission	Scope	Path
Config	Read only	Selected and sub nodes	`/modules/resources`
Category	Read/Write	Sub nodes	`/`
Contacts	Read	Selected	`/resources-base`

...

MultiExcerptName	rest-role-permissions

/Write	Sub nodes	`/`
Dam	Read/Write	Sub nodes	`/`
Userroles	Read only	Selected	`/editor`
Website	Read/Write	Sub nodes	`/`

Configured access

Applies to	App	Name	Path
Action	Pages

rest-admin

Web access

...

Permission

...

Path

...

Get & Post

...

/.rest/*

Configured access

...

Applies to

...

Name

...

Path

...

Commands

...

Delete

...

/modules/rest-services/rest-endpoints/commands/enabledCommands/markAsDeleted/access/roles

...

Activate /modules/

...

rest-editor

Web access

...

Permission

...

Path

...

Deny

...

/.rest*

...

Deny

...

/.rest/commands*

...

Deny

...

/.rest/nodes*

...

Get & Post

...

/.rest/nodes/v1/website*

...

Deny

...

/.rest/properties*

...

Get & Post

...

/.rest/properties/v1/website*

...

Get & Post

...

/.rest/cache/v1*

pages/apps/pages/subApps/browser/actions/activate/availability/access/roles

publisher

Installed by the workflow module (EE). Allows publishing content.

Access control lists

Workspace	Permission	Scope	Path
Category	Read only	Sub nodes	`/`
Contacts	Read only	Sub nodes	`/`
Dam	Read only	Sub nodes	`/`
Userroles	Read only	Selected	`/publisher`
Website	Read only	Sub nodes	`/`
Workflow	Read/Write	Sub nodes	`/`

rest-anonymous

Web access

...

Permission

...

Path

...

Deny

...

/.rest*

...

Get

...

/.rest/delivery/*

rest-backup

Web access

...

Permission

...

Path

...

Get & Post

...

Configured access

Applies to	App	Name	Path
Action	Pages

...

Command

...

Backup

Activate /modules/pages/apps/pages/subApps/browser/actions/activate/availability

...

/access/roles

...

workflow-base

Base role allowing users to use the workflow workspace (EE).

Access control lists

Workspace	Permission	Scope	Path

Rss

Workflow

Read

-only

/Write	Sub nodes	`/`
Userroles	Read only	Selected	`/`

rss

workflow-

aggregator

base

contact-base

...

Access control lists

Workspace Permission Scope Path
ScriptsContact Read /Writeonly Sub nodes `/`
Userroles Read only Selected `/scripter`
Web access
...
Configured access
...
`contact-base`

imaging-base

Access control lists

Workspace	Permission	Scope	Path
Imaging	Read only	Sub nodes	`/`
Userroles	Read only	Selected	`/imaging-base`

resources

security-base

Web access

...

-base

Access control lists

/templater-base

Workspace	Permission	Scope	Path
Config	Read - only	Selected and sub nodes	`/modules` /inplace-templating
Templates	Read/Write	Sub nodes	`/`
Userroles	Read only	Selected
`/resources`
Resources	Read/Write	Sub nodes	`/`
Userroles	Read only	Selected	`/resources-base`

Multiexcerpt

MultiExcerptName	rest-role-permissions

rest-admin

Web access

Permission	Path
Get & Post	`/.rest/*`

Configured access

Applies to

...

Name	Path

...


Commands	Delete	`/modules/rest-services/rest-endpoints/commands/enabledCommands/markAsDeleted/access/roles`
	Activate

...

/modules/

...

rest-services/rest-endpoints/commands/enabledCommands/activate/access/roles

...

rest-

...

Role that allows posting in all forums.

Access control lists

...

forum_ALL-admin

Role which gives administration permissions on ALL forums

Access control lists

...

/modules/forum/apps/forum/permissions/roles

...

editor

Web access

Permission	Path
Deny	`/.rest*`
Get	`/.rest/delivery/*`
Deny	`/.rest/commands*`
Deny	`/.rest/nodes*`
Get & Post	`/.rest/nodes/v1/website*`
Deny	`/.rest/properties*`
Get & Post	`/.rest/properties/v1/website*`
Get & Post	`/.rest/cache/v1*`

rest-anonymous

Web access

Permission	Path
Deny	`/.rest*`
Get	`/.rest/delivery/*`

rest-backup

Web access

Permission	Path
Get & Post	`/.rest/commands/v2/backup/backup`

Configured access

Applies to	Name	Path
Command	Backup	`/modules/rest-services/rest-endpoints/commands/enabledCommands/backup/access/roles`

rss-aggregator-base

Access control lists

Workspace	Permission	Scope	Path
Rss	Read-only	Sub nodes	`/`
Userroles	Read only	Selected	`/rss-aggregator-base`

scripter

forum_ALL-moderator

...

Access control lists

Workspace Permission Scope Path
ForumScripts Read/Write Sub nodes `/`
Userroles Read only Selected only Selected `/scripter`
Web access

Permission Path
Get & Post `*/forum_ALL-moderator`
Configured access
forumforum

Applies to App Path
App ForumGroovy `/modules/` `groovy/apps/` `groovy/permissions/roles`

forum-pagecomments-user

security-base

Web access

Permission	Path
Deny	`/.magnolia/log4j`
Deny	`/.rest*`

templater-base

Access control listsRole which gives commenting permissions.

Workspace	Permission	Scope	Path
ForumConfig	Read/Write-only	Selected and sub nodes	`/modules/inplace-templating`
Templates	Read/Write	Sub nodes	`/pagecomments`
Userroles	Read only	Selected	`/templater-base`

Configured access

/forum-pagecomments-user

Applies to	App	Path
App	Templates	`/modules/inplace-templating/apps/inplace-templating/permissions/roles`

Groups

Group permissions are the same on author and public instances.

...

Assigned groups	Assigned roles
(none)	`editor`
	`workflow-base`

publishers

Assigned groups	Assigned roles
(none)	`publisher`
		`workflow-base`

travel-demo-pur

...

Assigned groups	Assigned roles
(none)	`categorization-base`
	`contact-base`
	`forum-pagecomments-user`
	`imaging-base`
	`travel-demo-base`
	`travel-demo-pur`

travel-demo-editors

...

Assigned groups	Assigned roles
(none)	`travel-demo-admincentral`
	`travel-demo-editor`
	`travel-demo-tour-editor`
		`imaging-base`
	`security-base`
	`resources-base`
		`workflow-base`

travel-demo-publishers

...

Assigned groups	Assigned roles
(none)	`travel-demo-admincentral`
	`travel-demo-publisher`
	`travel-demo-tour-editor`
	`security-base`
		`workflow-base`

travel-demo-tour-editors

...

Assigned groups	Assigned roles
(none)	`travel-demo-admincentral`
	`travel-demo-base`
	`travel-demo-tour-editor`
		`security-base`
	`workflow-base`

Users

eric

User eric is an example editor.

...

Assigned groups	Assigned roles
(none)	`anonymous`
	`categorization-base`
	`contact-base`
		`forum-pagecomments-user`
	`imaging-base`
	`rest-anonymous`
	`travel-demo-base`

superuser (system user)

...

Assigned groups	Assigned roles
`publishers` (EE)	`superuser`
		`rest-admin`
	`forum_ALL_admin`

Workspace	Permission	Scope	Path
ContactCategory	Read only	Sub nodes	`/`
Userroles	Read only	Selected	`/contact-base`

Workspace	Permission	Scope	Path
ScriptsContact	Read /Writeonly	Sub nodes	`/`
Userroles	Read only	Selected	`/scripter`

Workspace	Permission	Scope	Path
ForumScripts	Read/Write	Sub nodes	`/`
Userroles	Read only	Selected	only	Selected	`/scripter`

Page tree

Page History

Versions Compared

Old Version 10

New Version Current

Key

Roles

anonymous (role, author instance)

Roles

anonymous (role, author instance)

Anchoranonymousrolepublicinstanceanonymousrolepublicinstanceanonymous (role, public instance)

superuser (role)

superuser (role)

travel-demo-base

travel-demo-admincentral

travel-demo-editor

travel-demo-

base

travel-demo-admincentral

travel-demo

-editor

editor

publisher

travel-demo-publisher

workflow-base

travel-demo-tour-editor

Access control lists WorkspacePermissionScopePathContactCategoryRead onlySub nodes/UserrolesRead onlySelected/contact-base

imaging-base

editor

rest-admin

rest-editor

publisher

rest-anonymous

rest-backup

workflow-base

contact-base

Access control lists WorkspacePermissionScopePathScriptsContactRead /WriteonlySub nodes/UserrolesRead onlySelected/scripterWeb access...Configured access...contact-base

imaging-base

resources

security-base

-base

rest-admin

rest-

forum_ALL-admin

editor

rest-anonymous

rest-backup

rss-aggregator-base

scripter

forum_ALL-moderator

Access control lists WorkspacePermissionScopePathForumScriptsRead/WriteSub nodes/UserrolesRead onlySelectedonlySelected/scripterWeb access PermissionPathGet & Post*/forum_ALL-moderatorConfigured accessforumforum Applies toAppPathAppForumGroovy/modules/groovy/apps/groovy/permissions/roles

forum-pagecomments-user

security-base

templater-base

Groups

publishers

travel-demo-pur

travel-demo-editors

travel-demo-publishers

travel-demo-tour-editors

Users

eric

superuser (system user)

Anchor
anonymousrolepublicinstance
anonymousrolepublicinstance
anonymous (role, public instance)

Access control lists

Workspace Permission Scope Path
ContactCategory
Read
only Sub nodes `/`
Userroles Read only Selected `/contact-base`

Access control lists

Workspace Permission Scope Path
ScriptsContact Read /Writeonly Sub nodes `/`
Userroles Read only Selected `/scripter`
Web access
...
Configured access
...
`contact-base`