Loading...
 

 Important

Major updates are in progress. Some pages and languages may not be available.

How Tiki's Permissions Work

It is important to understand that Tiki uses several types of permissions:

  • Group permissions: This is also called global permission. Each site visitor belongs to a Group (such as Anonymous or Registered). The permissions you assign to the group define the global permissions for that user.
  • Category permissions: These permissions define the actions that users can take for objects in a specific category.
  • Object permissions: These permissions define the actions that user can take for an individual object.


Permissions are inherited from from the top-down, but override from the bottom-up. This image illustrates the relationship among Group, Category, and Object permissions:
The relationship of Group-Category-Object permissions

Tiki's permissions model may be very complex... but it is also very customizable.

Permissions Example

Consider the following example for a company using Tiki. You have the groups:

  • Anonymous
  • Registered
  • Admins
  • Employees
  • Board of Directors

Listing Groups page
The Groups for ABC Company


Notice that some groups include other groups. For example, members of the Board of Directors group will include, in addition to their own permissions, the permissions from the Employees, Registered, and Anonymous groups.

You have the categories:

  • Financial Information
  • Press Releases


You want to give:

  • Everyone permission to read most pages
  • Employees permission to edit most wiki pages
  • Board Members only, access to the company's financial information.


Global (Group) Permissions

First, you need to define the global permissions for each group.

Global Permissions
Defining the Global permissions for each group.

Anonymous

  • To let the general public (that is, anonymous visitors) view wiki pages, assign tiki_p_view to Anonymous.

Employees

  • The Employee group includes the Anonymous group (that is, everyone) and Registered group (that is, users who are logged in). Therefore, the Employee group inherits the tiki_p_view permission from these groups.
  • To let employees edit pages, assign tiki_p_edit to Employees.

Board of Directors

  • The Board of Directors group includes the Anonymous, Registered, and Employees groups. Therefore, the Board of Directors group inherits the tiki_p_view and tiki_p_edit permission from these groups.
    This group does not require any additional permissions.

Category Permissions

Now that the Global permissions are set, you need to adjust the permissions for each category. These settings will override the Global permissions.

Press Releases

Currently, Anonymous can view press releases, and Employees can edit them (as defined by the Global permissions). To allow only the Board of Directors to edit press releases, you must assign permissions to the category. This will override the default group (global) permissions:

  • For the Press Releases category, remove tiki_p_edit from Employee. Now only the Board of Directors group can edit wiki pages in the category.
  • Anonymous visitors (and all groups that inherit the Anonymous group's permissions) can still view the pages.
Category Permissions
Defining the Category permissions for the Press Releases category.

Financial Information

Currently, Anonymous can view Financial Information, and Employees can edit them. But we want only the Board of Directors to have access (both view and edit) to these pages. You'll need to make the same adjustments to the Financial Information category's permissions:

  • Remove tiki_p_edit from Employee. Now only the Board of Directors group can edit wiki pages in the category.
  • Remove tiki_p_view from Employee, Registered, and Anonymous. Now only the Board of Directors can see the pages.

Object Permissions

But what if you want one item in the Financial Information category, to be visible to the public? You can override all other permissions, by assigning specific permissions to the object itself. For example, the ABC Company may have a public disclosure form, issued by the government, that it needs to make public (but that only the government can change or update):

  • For the individual item, remove tiki_p_edit from the Employee and Board of Directors group. Since this form is issued by the government, no one should be able to change it.
  • Anonymous visitors (and all groups that inherit the Anonymous group's permissions) can still view the pages.
Object Permissions
Assigning object-specific permissions to the PublicDisclosure page.

 Note

See Group vs Category Permissions for additional information on Tiki permissions.

Created by Rick Sapir (ricks99). Last Modification: Tuesday October 8, 2019 09:12:08 am EDT by Rick Sapir (ricks99).

Advertising