Warning: This page has not been updated in over over a year and may be outdated or deprecated.
configuration:permission_options
Differences
This shows you the differences between two versions of the page.
Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
configuration:permission_options [2017/08/30 14:41] – demiankatz | configuration:permission_options [2023/11/09 19:10] (current) – demiankatz | ||
---|---|---|---|
Line 1: | Line 1: | ||
====== Permission Configuration ====== | ====== Permission Configuration ====== | ||
- | VuFind | + | VuFind® |
- | VuFind | + | VuFind® |
+ | VuFind® 6.1 adds a significant new option to permissionBehavior.ini: | ||
===== Structure of permissionBehavior.ini ===== | ===== Structure of permissionBehavior.ini ===== | ||
Line 11: | Line 12: | ||
deniedTemplateBehavior controls the display of template content associated with the permission. If you want to show the content only to people who have logged in, you could define a permission rule in permissions.ini and reference that in permissionBehavior.ini, | deniedTemplateBehavior controls the display of template content associated with the permission. If you want to show the content only to people who have logged in, you could define a permission rule in permissions.ini and reference that in permissionBehavior.ini, | ||
- | deniedControllerBehavior controls | + | deniedControllerBehavior controls |
As noted above, all possible values for these options are documented in permissionBehavior.ini. | As noted above, all possible values for these options are documented in permissionBehavior.ini. | ||
Line 17: | Line 18: | ||
See also the following examples, which should illustrate some use cases with permissionBehavior. | See also the following examples, which should illustrate some use cases with permissionBehavior. | ||
- | ===== Other useful configuration | + | ===== Other useful configuration |
- | VuFind | + | ==== Search Tabs Permissions ==== |
+ | |||
+ | VuFind® | ||
Note that [SearchTabsPermissions] ONLY controls the rendering of tabs. It does not prevent users from accessing the searches that those tabs can produce. To restrict actual searching, you will need to pair some controller-specific rules with your search tab permissions. Examples can be found below. | Note that [SearchTabsPermissions] ONLY controls the rendering of tabs. It does not prevent users from accessing the searches that those tabs can produce. To restrict actual searching, you will need to pair some controller-specific rules with your search tab permissions. Examples can be found below. | ||
Line 25: | Line 28: | ||
===== Checking permissions in code ===== | ===== Checking permissions in code ===== | ||
- | Starting with VuFind | + | Starting with VuFind® |
==== Controllers ==== | ==== Controllers ==== | ||
- | Since VuFind | + | Since VuFind® |
- | VuFind | + | VuFind® |
- | VuFind | + | VuFind® |
< | < | ||
Line 46: | Line 49: | ||
==== Templates ==== | ==== Templates ==== | ||
- | It was not possible to check permissions in templates until VuFind | + | It was not possible to check permissions in templates until VuFind® |
< | < | ||
Line 66: | Line 69: | ||
// If a user accesses a restricted page, show a login page as default (unless a deniedControllerBehavior directive overrides that). // | // If a user accesses a restricted page, show a login page as default (unless a deniedControllerBehavior directive overrides that). // | ||
- | PermissionBehavior.ini: | + | permissionBehavior.ini: |
[global] | [global] | ||
defaultDeniedControllerBehavior = " | defaultDeniedControllerBehavior = " | ||
Line 74: | Line 77: | ||
// If a user accesses a restricted page, show a note as default (unless a deniedControllerBehavior directive overrides that). // | // If a user accesses a restricted page, show a note as default (unless a deniedControllerBehavior directive overrides that). // | ||
- | PermissionBehavior.ini: | + | permissionBehavior.ini: |
[global] | [global] | ||
defaultDeniedControllerBehavior = " | defaultDeniedControllerBehavior = " | ||
Line 84: | Line 87: | ||
// Only users from certain IPs are allowed to use the AdminModule. If an unauthorized user enters the Admin module, show a note. // | // Only users from certain IPs are allowed to use the AdminModule. If an unauthorized user enters the Admin module, show a note. // | ||
- | Permissions.ini: | + | permissions.ini: |
[default.AdminModule] | [default.AdminModule] | ||
ipRange = " | ipRange = " | ||
Line 99: | Line 102: | ||
// The button to save a record as a favorite record should be only displayed after a user has logged in. // | // The button to save a record as a favorite record should be only displayed after a user has logged in. // | ||
- | Permissions.ini: | + | permissions.ini: |
[default.Favorites] | [default.Favorites] | ||
role[] = loggedin | role[] = loggedin | ||
permission = feature.Favorites | permission = feature.Favorites | ||
- | PermissionBehavior.ini: | + | permissionBehavior.ini: |
[feature.Favorites] | [feature.Favorites] | ||
deniedTemplateBehavior = " | deniedTemplateBehavior = " | ||
Line 112: | Line 115: | ||
// The button to save a record as a favorite record should be always displayed, but if a user is not logged in, he should be forced to login. // | // The button to save a record as a favorite record should be always displayed, but if a user is not logged in, he should be forced to login. // | ||
- | (This is the default behavior in VuFind | + | (This is the default behavior in VuFind® |
- | Permissions.ini: | + | permissions.ini: |
[default.Favorites] | [default.Favorites] | ||
role[] = loggedin | role[] = loggedin | ||
permission = feature.Favorites | permission = feature.Favorites | ||
- | PermissionBehavior.ini: | + | permissionBehavior.ini: |
[feature.Favorites] | [feature.Favorites] | ||
deniedControllerBehavior = " | deniedControllerBehavior = " | ||
Line 125: | Line 128: | ||
==== Primo Central ==== | ==== Primo Central ==== | ||
- | * You are using the PrimoCentral index and are offering it with a seperate register (SearchTab). The user should be allowed to see the register | + | === Suppress |
- | Permissions.ini: | + | // You are using the PrimoCentral index and are offering it with a separate search tab. The user should be allowed to see the tab only if logged in or within a certain IP range. Otherwise the search tab should not get displayed. // |
+ | |||
+ | config.ini: | ||
+ | [SearchTabs] | ||
+ | Solr = Main | ||
+ | Primo = Extra | ||
+ | |||
+ | [SearchTabsPermissions] | ||
+ | Primo = access.PrimoModule | ||
+ | |||
+ | permissions.ini: | ||
[default.primo] | [default.primo] | ||
require = ANY | require = ANY | ||
ipRange = " | ipRange = " | ||
role[] = loggedin | role[] = loggedin | ||
- | permission = access.Primo | + | permission = access.PrimoModule |
- | PermissionBehavior.ini: | + | permissionBehavior.ini: |
- | [access.Primo] | + | [access.PrimoModule] |
- | | + | |
- | * You are using the PrimoCentral index and are offering it with a seperate register (SearchTab). Any user should be allowed to see the register tab, but if the tab is clicked, the user should see a note telling him that he needs to be in a certain | + | === Show note outside of IP range === |
- | Permissions.ini: | + | // You are using the PrimoCentral index and are offering it with a separate search tab. Any user should be allowed to see the tab, but if the tab is clicked, the user should see a note telling him that he needs to be logged in or within a certain IP range to use this tab. // |
- | [default.primo] | + | |
- | require = ANY | + | |
- | ipRange = " | + | |
- | role[] = loggedin | + | |
- | permission = access.Primo | + | |
- | PermissionBehavior.ini: | + | config.ini and permissions.ini should be the same as the previous example. |
- | [access.Primo] | + | |
- | permissionDeniedAction = " | + | |
- | * You are using the PrimoCentral index and are offering it with a seperate register (SearchTab). Any user should be allowed to see the register tab, but if the tab is clicked, system should throw an exception. | + | permissionBehavior.ini: |
+ | [access.PrimoModule] | ||
+ | deniedControllerBehavior = " | ||
- | Permissions.ini: | + | === Throw exception outside of IP range === |
- | [default.primo] | + | |
- | require | + | |
- | ipRange | + | |
- | role[] | + | |
- | permission | + | |
- | PermissionBehavior.ini: | + | // You are using the PrimoCentral index and are offering it with a separate search tab. Any user should be allowed to see the tab, but if the tab is clicked, the system should throw an exception when permission is denied. // |
- | [access.Primo] | + | |
- | | + | config.ini and permissions.ini should be the same as the previous example. |
+ | |||
+ | permissionBehavior.ini: | ||
+ | [access.PrimoModule] | ||
+ | | ||
---- struct data ---- | ---- struct data ---- | ||
+ | properties.Page Owner : | ||
---- | ---- | ||
configuration/permission_options.1504104068.txt.gz · Last modified: 2017/08/30 14:41 by demiankatz