Magnolia 5.6 reached end of life on June 25, 2020. This branch is no longer supported, see End-of-life policy.
Page History
The These are default permissions set up in Magnolia. You can manage them in the Security app demonstrate how to assign roles, ACLs and web access . The default permissions are just an example how to grant permissions in a typical scenario. These permissions are complemented by configured app access.
The Security app allows you to view a comprehensive list of permissions assigned to any user or group at any point in time. If you need to revert to the default permissions for any reason, you can access them online in the demo site in the Tools tab of the Security app.
The tables below show default permissions, role and group assignments, and configured access permissions.
| Table of Contents |
|---|
Roles
anonymous (role, author instance)
The anonymous role defines the permissions of public, unauthenticated users. Permissions are different on the author and public instances.
Access control lists
...
Web access
...
Access control lists
...
Web access
...
superuser (role)
The superuser role provides full access to the system. The permissions are the same on author and public instances.
Access control lists
...
Web access
...
Configured access
...
/modules/workflow/messageViews/publish/actions/abort/availability/access/roles...
website. You should adapt the permissions to match your own organization. App access is configured separately in the app launcher configuration.
| Table of Contents |
|---|
Roles
anonymous (role, author instance)
The anonymous role defines the permissions of public, unauthenticated users. Permissions are different on the author and public instances.
Access control lists
| Workspace | Permission | Scope | Path |
|---|---|---|---|
| Category | Read only | Selected and sub nodes | / |
| DAM | Read only | Sub nodes | / |
| GoogleSitemaps | Read only | Selected and sub nodes | / |
| Marketing-tags | Read only | Selected and sub nodes | / |
| Resources | Read only | Sub nodes | / |
| Website | Deny access | Sub nodes | / |
Web access
| Permission | Path |
|---|---|
| Deny | * |
| Deny | /.magnolia* |
| Anchor | ||||
|---|---|---|---|---|
|
Access control lists
| Workspace | Permission | Scope | Path |
|---|---|---|---|
| Category | Read only | Selected and sub nodes | / |
| Dam | Read only | Selected and sub nodes | / |
| GoogleSitemaps | Read only | Selected and sub nodes | / |
| Marketing-tags | Read only | Selected and sub nodes | / |
| Resources | Read only | Sub nodes | / |
| Website | Read only | Sub nodes | / |
Web access
| Permission | Path |
|---|---|
| Get & Post | * |
| Deny | /.magnolia |
| Deny | /.magnolia/* |
| Deny | /travel/members/protected* |
| Deny | /travel/members/profile-update* |
| Deny | <travel>/members/protected* |
| Deny | <travel>/members/profile-update* |
superuser (role)
The superuser role provides full access to the system. The permissions are the same on author and public instances.
Access control lists
| Workspace | Permission | Scope | Path |
|---|---|---|---|
| AdvancedCache | Read/Write | Sub nodes | / |
| Category | Read/Write | Sub nodes | / |
| Config | Read/Write | Sub nodes | / |
| Contacts | Read/Write | Sub nodes | / |
| Dam | Read/Write | Sub nodes | / |
| Dms* | Read/Write | Sub nodes | / |
| Forum | Read/Write | Sub nodes | / |
| GoogleSitemaps | Read/Write | Sub nodes | / |
| Imaging | Read/Write | Sub nodes | / |
| Keystore | Read/Write | Sub nodes | / |
| Marketing-tags | Read/Write | Sub nodes | / |
| Messages | Read/Write | Sub nodes | / |
| Personas | Read/Write | Sub nodes | / |
| Profiles | Read/Write | Sub nodes | / |
| Resources | Read/Write | Sub nodes | / |
| Rss | Read/Write | Sub nodes | / |
| Scripts | Read/Write | Sub nodes | / |
| Segments | Read/Write | Sub nodes | / |
| Stories | Read/Write | Sub nodes | / |
| Tags | Read/Write | Sub nodes | / |
| Tasks | Read/Write | Sub nodes | / |
| Templates | Read/Write | Sub nodes | / |
| Tours | Read/Write | Sub nodes | / |
| Usergroups | Read/Write | Sub nodes | / |
| Userroles |
travel-demo-base
These are roles specific to the demo websites. The permissions are the same on author and public instances.
Access control lists
...
Read only
Read only
...
Selected and sub nodes
Selected and sub nodes
...
/tour-types
/destinations
...
travel-demo-admincentral
These are roles specific to the demo-project example websites. The permissions are the same on author and public instances.
Web access
...
travel-demo-editor
Access control lists
| Workspace | Permission | Scope | Path |
|---|---|---|---|
| Category | Read/Write | Sub nodes | / |
| Users | Read/Write | Sub nodes | / |
| UserrolesWebsite | Read only/Write | SelectedSub nodes | /travel-demo-editorWebsite |
| Workflow (EE) | Read/Write | Sub nodes | / |
Web access
| Permission | Path |
|---|---|
| Get & Post | * |
Configured access
| Applies to | Name | Path | |||||
|---|---|---|---|---|---|---|---|
| App | Name | Path | Activation | /modules/activation/apps/activation/permissions/roles | |||
| Configuration | /modules/ui-admincentral/apps/configuration/permissions/roles | ||||||
| Security | App | Assets | /modules/damsecurity-app/apps/assetssecurity/permissions/roles | ||||
| ActionSecurity | Assets | Activate | /modules/damsecurity-app/appsdialogs/assetsrole/subAppsform/browsertabs/actionsrole/activate/availability/access/roles | Action | Pages | fields/jcrName | |
| Mail toolsActivate | /modules/pagesmail/apps/pages/subApps/browser/actions/activate/availability/access/roles |
travel-demo-publisher
Access control lists
...
mail/permissions/roles | ||
| Dev tools | /modules/tools/apps/tools/permissions/roles | |
| Backup | /modules/backup/apps/backup/permissions/roles | |
| App launcher | Dev group | /modules/ui-admincentral/config/appLauncherLayout/groups/dev/permissions/roles |
| Tools group | /modules/ui-admincentral/config/appLauncherLayout/groups/tools/permissions/roles | |
| Pulse | Abort action | /modules/workflow/messageViews/publish/actions/abort |
Configured access
| Applies to | App | Name | Path | |||
|---|---|---|---|---|---|---|
| App | Assets | /modules/dam-app/apps/assets/permissions/roles | ||||
| Action | Assets | Activate | /modules/dam-app/apps/assets/subApps/browser/actions/activate/availability/access/roles | Action | Pages | Activate |
| Archive action | /modules/pagesworkflow/appsmessageViews/pagespublish/subApps/browser/actions/activatearchive/availability/access/roles |
travel-demo-
...
base
These are roles specific to the demo websites. The permissions are the same on author and public instances.
Access control lists
| Workspace | Permission | Scope | Path | |
|---|---|---|---|---|
| Category | Read /Writeonly Read /Writeonly | Selected and sub nodes Selected and sub nodes |
| |
| Dam | Read | /only | Sub nodes | / |
| Tours | Read only | WriteSub nodes | / | |
| Tours | Read/Write | Sub nodes | / | |
| Userroles | Read only | Selected | /travel-demo-tour-editor |
editor
Installed by the workflow module (EE). Allows editing content.
| Userroles | Read only | Selected | /travel-demo-base |
travel-demo-admincentral
These are roles specific to the demo-project example websites. The permissions are the same on author and public instances.
Web access
| Permission | Path |
|---|---|
| Get & Post | * |
travel-demo-editor
Access control lists
| Workspace | Permission | Scope | Path | ||||
|---|---|---|---|---|---|---|---|
| Category | Read/Write | Sub nodes | / | Contacts | Read/Write | Sub nodes | / |
| Dam | Read/Write | Sub nodes | / | ||||
| Userroles | Read only | Selected | /travel-demo-/editor | ||||
| Website | Read/Write | Sub nodes | / |
Configured access
| Applies to | App | Name | Path |
|---|---|---|---|
| App | Assets | /modules/dam-app/apps/assets/permissions/roles | |
| Action | Assets | Activate | /modules/dam-app/apps/assets/subApps/browser/actions/activate/availability/access/roles |
| Action | Pages | Activate | /modules/pages/apps/pages/subApps/browser/actions/activate/availability/access/roles |
publisher
Installed by the workflow module (EE). Allows publishing content.
travel-demo-publisher
Access control lists
| Workspace | Permission | Scope | Path | Category | Read only | Sub nodes | |
|---|---|---|---|---|---|---|---|
| Contacts | Read only | Sub nodes | / | ||||
| Dam | Read only | Sub nodes | / | ||||
| Userroles | Read only | Selected | /publisher | Website | Read only | Sub nodes/travel-demo-publisher | |
| WorkflowWebsite | Read/Write | Sub nodes | / |
Configured access
| Applies to | App | Name | Path |
|---|---|---|---|
| App | Assets | /modules/dam-app/apps/assets/permissions/roles | |
| Action | Assets | Activate | /modules/dam-app/apps/assets/subApps/browser/actions/activate/availability/access/roles |
| Action | Pages | Activate | /modules/pages/apps/pages/subApps/browser/actions/activate/availability/access/roles |
workflow-base
Base role allowing users to use the workflow workspace (EE).
Access control lists
...
travel-demo-tour-editor
Access control lists
| Workspace | Permission | Scope | Path |
|---|---|---|---|
| ContactCategory | Read only | Sub nodes | / |
| Userroles | Read only | Selected | /contact-base |
imaging-base
Access control lists
/Write Read/Write | Selected and sub nodes Selected and sub nodes |
| |
| Dam | Read/Write | Sub nodes | / |
| Tours | Read/Write | ||
| Workspace | Permission | Scope | Path |
|---|---|---|---|
| Imaging | Read onlySub nodes | / | |
| Userroles | Read only | Selected | / | imaging-base
...
travel-demo-tour-editor |
editor
Installed by the workflow module (EE). Allows editing content.
Access control lists
| Workspace | Permission | Scope | Path | |
|---|---|---|---|---|
| ConfigCategory | Read only/Write | Sub Selected and sub nodes | /modules/resources | |
| Contacts | Read/Write | Sub nodes | / | |
| Dam | Read | only/Write | SelectedSub nodes | / | resources-base
...
| MultiExcerptName | rest-role-permissions |
|---|
rest-admin
Web access
| Userroles | Read only | Selected | /editor |
| Website | Read/Write | Sub nodes | / |
...
Permission
...
Path
...
Get & Post
...
Configured access
| Applies to | App | Name | Path |
|---|
...
| Action | Pages |
...
| Activate | /modules/ |
...
...
Activate
...
/modules/rest-services/rest-endpoints/commands/enabledCommands/activate/access/rolesrest-editor
Web access
...
Permission
...
Path
...
Deny
...
/.rest*
...
Deny
...
/.rest/commands*
...
Deny
...
/.rest/nodes*
...
Get & Post
...
/.rest/nodes/v1/website*
...
Deny
...
/.rest/properties*
...
Get & Post
...
/.rest/properties/v1/website*
pages/apps/pages/subApps/browser/actions/activate/availability/access/roles |
publisher
Installed by the workflow module (EE). Allows publishing content.
Access control lists
| Workspace | Permission | Scope | Path |
|---|---|---|---|
| Category | Read only | Sub nodes | / |
| Contacts | Read only | Sub nodes | / |
| Dam | Read only | Sub nodes | / |
| Userroles | Read only | Selected | /publisher |
| Website | Read only | Sub nodes | / |
| Workflow | Read/Write | Sub nodes | / |
...
Get & Post
...
Configured access
| Applies to | App | Name | Path |
|---|
...
Commands
...
Delete
...
/modules/rest-services/rest-endpoints/commands/enabledCommands/markAsDeleted/access/roles
| Action | Pages |
...
| Activate | /modules |
...
/pages/apps/pages/subApps/browser/actions/activate/availability/access/roles |
...
workflow-
...
Web access
...
Permission
...
Path
...
Deny
...
/.rest*
...
Get
...
/.rest/delivery/*
Configured access
...
Applies to
...
Name
...
Path
...
Commands
...
Delete
...
/modules/rest-services/rest-endpoints/commands/enabledCommands/markAsDeleted/access/roles
...
...
Activate
...
/modules/rest-services/rest-endpoints/commands/enabledCommands/activate/access/rolesrest-backup
Web access
...
Permission
...
Path
...
Get & Post
...
/.rest/commands/v2/backup/backup
base
Base role allowing users to use the workflow workspace (EE).
Access control lists
| Workspace | Permission | Scope | Path |
|---|---|---|---|
| Workflow | Read/Write | Sub nodes | / |
| Userroles | Read only | Selected | /workflow-base |
contact-base
Access control lists
| Workspace | Permission | Scope | Path |
|---|---|---|---|
| Contact | Read only | Sub nodes | / |
| Userroles | Read only | Selected | /contact-base |
imaging-base
Access control lists
| Workspace | Permission | Scope | Path |
|---|---|---|---|
| Imaging | Read only | Sub nodes | / |
| Userroles | Read only | Selected | /imaging-base |
resources
Configured access
...
Applies to
...
Name
...
Path
...
Commands
...
Delete
...
/modules/rest-services/rest-endpoints/commands/enabledCommands/markAsDeleted/access/roles
...
...
Activate
...
/modules/rest-services/rest-endpoints/commands/enabledCommands/activate/access/roles
...
-base
Access control lists
| Workspace | Permission | Scope | Path |
|---|---|---|---|
| RssConfig | Read -only | Selected and sub nodes |
|
| Resources | Read/Write | Sub nodes | / |
| Userroles | Read only | Selected | / |
scripter
Access control lists
...
resources-base |
| Multiexcerpt | ||
|---|---|---|
| ||
rest-adminWeb access
|
...
|
...
|
...
Web access
...
Configured access
...
Configured access
rest-editor |
...
Web access
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
rest-anonymousWeb access
|
...
|
...
|
...
|
...
|
...
|
...
...
rest |
...
- |
...
Access control lists
...
backupWeb access
|
...
|
...
|
Configured access
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
forum_ALL-user
...
rss-aggregator-base
Access control lists
| Workspace | Permission | Scope | Path |
|---|---|---|---|
| ForumRss | Read/Write-only | Sub nodes | / |
...
| Userroles | PermissionRead only | PathSelected |
| Get & Post | /.magnolia/pages/forum* |
forum_ALL-admin
...
/rss-aggregator-base |
scripter
Access control lists
| Workspace | Permission | Scope | Path |
|---|---|---|---|
| ForumScripts | Read/Write | Sub nodes | / |
| Userroles | Read only | Selected | /scripter |
Web access
| Permission | Path | |
|---|---|---|
| Get & Post | /.magnolia/pages/forum* |
Configured access
| Applies to | AppName | Path | |||
|---|---|---|---|---|---|
| App | Forum | /modules/forum/apps/forum/permissions/roles | |||
| Actions | Forum | Add forum | /modules/forum/apps/forum/subApps/browser/actions/addForum/availability/access/roles | ||
| Groovy | Edit forum | /modules/forumgroovy/apps/forumgroovy/subApps/browser/actions/editForum/availability/access/roles | |||
| Delete forum | /modules/forum/apps/forum/subApps/browser/actions/deleteForum/availability/access/roles | ||||
| Confirm delete | /modules/forum/apps/forum/subApps/browser/actions/confirmDeleteForum/availability/access/roles |
forum_ALL-moderator
Role which gives moderation permissions on ALL forums
Access control lists
...
Web access
...
Configured access
...
/modules/forum/apps/forum/permissions/rolespermissions/roles |
security-base
Web access
| Permission | Path |
|---|---|
| Deny | /.magnolia/log4j |
| Deny | /.rest* |
templater-base
Access control lists
| Workspace | Permission | Scope | Path |
|---|---|---|---|
| Config | Read-only | Selected and sub nodes | /modules/inplace-templating |
| Templates | Read/Write | Sub nodes | / |
| Userroles | Read only | Selected | /templater-base |
Configured access
| Applies to | App | Path |
|---|---|---|
| App | Templates | /modules/inplace-templating/apps/inplace-templating/permissions/roles |
Groups
Group permissions are the same on author and public instances.
editors
| Assigned groups | Assigned roles |
|---|---|
| (none) | editor |
workflow-base |
publishers
| Assigned groups | Assigned roles |
|---|---|
| (none) | publisher |
workflow-base |
travel-demo-pur
The travel-demo-pur group is used to organize the editors of the sample websites.
| Assigned groups | Assigned roles |
|---|---|
| (none) | categorization-base |
contact-base | |
forum-pagecomments-user | |
imaging-base | |
travel-demo-base | |
travel-demo-pur |
forum-pagecomments-user
Role which gives commenting permissions.
...
Groups
...
travel-demo-editors
The travel-demo-editors group is used to organize the editors of the sample websites.
| Assigned groups | Assigned roles | ||
|---|---|---|---|
| (none) | travel-demo-admincentral | ||
travel-demo-editor | |||
travel-demo-tour-editor | |||
imaging-base | |||
security-base | |||
resources-base | |||
workflow-base |
travel-demo-publishers
...
| Assigned groups | Assigned roles | |
|---|---|---|
| (none) | travel-demo-admincentral | |
travel-demo-publisher | ||
travel-demo-tour-editor | ||
security-base | ||
workflow-base |
travel-demo-tour-editors
The travel-demo-tour-editors group is used to organize editors in the tour apps of the sample websites.
...
.
| Assigned groups | Assigned roles | ||
|---|---|---|---|
| (none) | editor | travel-demo-admincentral | |
travel-demo | workflow-base |
publishers
travel-demo-tour-editor | |
security-base | |
| Assigned groups | Assigned roles |
|---|---|
| (none) | publisher |
workflow-base |
Users
eric
User eric is an example editor.
...
| Assigned groups | Assigned roles |
|---|---|
| (none) |
peter
User peter is an example publisher.
| Assigned groups | Assigned roles |
|---|---|
| (none) |
tina
User tina is an example tour editor.
...
| Assigned groups | Assigned roles | |
|---|---|---|
| (none) | anonymous | |
categorization-base | ||
contact-base | ||
forum-pagecomments-user | ||
imaging-base | ||
rest-anonymous | ||
travel-demo-base |
superuser (system user)
...
| Assigned groups | Assigned roles |
|---|---|
publishers (EE) | |
rest -admin | |
forum_ALL_admin |
Overview
Content Tools