Role and Permission management

Prerequisites

This tutorial requires the completion of the following tutorials:

Content of this tutorial

In this tutorial, we will create specific permissions and roles and use those to protect privileged features and displays.

We will use the following content type definition:

 


 
 
[jnt:intranetDashboard] > jnt:content, jmix:structuredContent
 
- welcomeMessage (string) i18n

 

 

And the following view:


 
 
<%@ page language="java" contentType="text/html;charset=UTF-8" %>
 
<%@ taglib prefix="template" uri="http://www.jahia.org/tags/templateLib" %>
 
<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>
 
<%@ taglib prefix="fn" uri="http://java.sun.com/jsp/jstl/functions" %>
 
<%@ taglib prefix="fmt" uri="http://java.sun.com/jsp/jstl/fmt" %>
 
<%@ taglib prefix="jcr" uri="http://www.jahia.org/tags/jcr" %>
 
<%@ taglib prefix="ui" uri="http://www.jahia.org/tags/uiComponentsLib" %>
 
<%@ taglib prefix="functions" uri="http://www.jahia.org/tags/functions" %>
 
<%@ taglib prefix="query" uri="http://www.jahia.org/tags/queryLib" %>
 
<%@ taglib prefix="utility" uri="http://www.jahia.org/tags/utilityLib" %>
 
<%@ taglib prefix="s" uri="http://www.jahia.org/tags/search" %>
 
 
 
<div class="intranet-welcome">${currentNode.properties.welcomeMessage.string}</div>
 
 
 
Shortcuts:
 
<ul>
 
<li><a href="/cms/news">Read the latest corporate news</a></li>
 
<li><a href="/cms/profile/update">Manage your corporate profile</a></li>
 
<li><a href="/cms/intranet/administration">Access the administration console</a></li>
 
</ul>

 

 

This view is by no means a good example: labels and URLs are hardcoded. But it is simple and will serve our Roles and Permissions tutorial well.

The main issue with the view is with the access to the administration console. Only a subset of the users should have access to it, but it is displayed to all right now.

How to create a permission

Permissions are created in a Jahia module (link to the Module creation tutorial) under the folder src/main/imports as XML files.

The name of the file is permissions.xml


 
 
<?xml version="1.0" encoding="UTF-8"?>
 
<permissions jcr:primaryType="jnt:permission"
 
xmlns:jcr="http://www.jcp.org/jcr/1.0"
 
xmlns:j="http://www.jahia.org/jahia/1.0"
 
xmlns:jnt="http://www.jahia.org/jahia/nt/1.0">
 
<canViewIntranetAdmin jcr:primaryType="jnt:permission"/>
 
</permissions>

 

 

We have just defined a new permission: canViewIntranetAdmin

The module needs to be re-built and deployed for the permission to become active.

How to create a role

Role management is very similar to permission management, except that it also has a management UI. This tutorial will focus on the role creation via a Jahia Module.

under the folder src/main/imports create a file roles.xml


 
 
<?xml version="1.0" encoding="UTF-8"?>
 
<roles jcr:primaryType="jnt:roles"
 
xmlns:jcr="http://www.jcp.org/jcr/1.0"
 
xmlns:j="http://www.jahia.org/jahia/1.0"
 
xmlns:jnt="http://www.jahia.org/jahia/nt/1.0">
 
<intranetAdministrator jcr:primaryType="jnt:role" j:roleGroup="edit-role"
 
j:permissions="/permissions/canViewIntranetAdmin"
 
 
 
/>
 
</roles>

 

 

With this file, we created a new role intranetAdministrator. This new role grants the permission canViewIntranetAdmin.

The module needs to be re-built and deployed for the role to become active.

How to assign a role to a user

Roles are assigned on a piece of content, and inherited by all contents below. A role 'Editor in Chief' configured on the homepage will apply to all subpages, unless the inheritance is broken.

When editing a piece of content, click "Live role" or 'Edit role', depending on whether the role should apply on edit mode or on the live site.

 


 

Edit > Advanced Options > Live Roles > Add user to the intranetAdministrator role

How to use a permission a JSP

The JSTL taglib jcr provides a hasPermission method. In our previous example, the following code would only display the link to the administration console to those with the permission canViewIntranetAdmin.


 
 
<%@ page language="java" contentType="text/html;charset=UTF-8" %>
 
<%@ taglib prefix="template" uri="http://www.jahia.org/tags/templateLib" %>
 
<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>
 
<%@ taglib prefix="fn" uri="http://java.sun.com/jsp/jstl/functions" %>
 
<%@ taglib prefix="fmt" uri="http://java.sun.com/jsp/jstl/fmt" %>
 
<%@ taglib prefix="jcr" uri="http://www.jahia.org/tags/jcr" %>
 
<%@ taglib prefix="ui" uri="http://www.jahia.org/tags/uiComponentsLib" %>
 
<%@ taglib prefix="functions" uri="http://www.jahia.org/tags/functions" %>
 
<%@ taglib prefix="query" uri="http://www.jahia.org/tags/queryLib" %>
 
<%@ taglib prefix="utility" uri="http://www.jahia.org/tags/utilityLib" %>
 
<%@ taglib prefix="s" uri="http://www.jahia.org/tags/search" %>
 
 
 
<c:if test="${jcr:hasPermission[c][d][e][f](currentNode, 'canViewIntranetAdmin')}">
 
<li><a href="/cms/intranet/administration">Access the administration console</a></li>
 
</c:if>

 

Do not forget to define a cache .properties file to have a cache.perUser = true configuration. [Add a link towards to view caching tutorial]

How to use a permission in Java

The Java-based permission usage is very similar to the JSP approach:


 
 
JCRNodeWrapper page = jcrSessionWrapper.getNode("/sites/mySite/home");
 
if (page.hasPermission("canViewIntranetAdmin")) {
 
// restricted action
 
}

 

 

This piece of code will make sure that the currently logged-in user has the permission canViewIntranetAdmin on the page before executing some logic.

Congratulations!  You have created a permission and a role!  The next step is to learn about search and queries.