Visitors, Roles and Permissions in Jyve

by Bernie Höneisen, ETH Zurich; Jon S. Stevens

Introduction

The purpose of this document is to get familiar with the roles and permissions in Jyve. In the beginning it describes the existing roles and permissions. Then it deals with different ways of user management and sample commands for modifying the system. You will see that the system is quite easy to understand and administrate once all of the terminology becomes clear. It is also quite powerful and should give a fairly high level of control over the entire permissions scheme and your Jyve FAQ. If there is missing functionality that you would like to see implemented, either help contribute or post a detailed explanation of what you would like to do to the mailing list.

Note: Roles are sometimes called groups, and users are sometimes called visitors. Basically there are users, roles and permissions. A user can have one or more roles. The permissions assigned to the roles (NOT to user). More information about this can be found in the Turbine FSD.

Existing Roles

Currently the following default roles exist in Jyve.
 
Name of the Role Short Description
root:  Role with all permissions
user_admin:  Role which handles the user administration
admin:  Role with all add_*, modify_*, release_* permissions, but usually no user_admin permissions.
trusted_user:  Role which can be assigned more permissions to (e.g. add_* and modify_*, ...)
authenticated_user:  Default role for users with a valid email address. Typically there are two cases: 
  1. add_* and modify_own_* permissions or 
  2. add_unreleased_* and modify_own_unreleased_* permissions 
guest:  Role with no special Permission (can only see the entries)

Feel free to assign the permissions according your taste. But take special care about what you assign to the role of the 'authenticated_user' and to the 'guest' role. Everybody with a valid email address can get the role of an 'authenticated_user' and everyone can login as a guest without a password. A special status has the 'user_admin' role. Currently there are no permissions assigned to the 'user_admin' role (in the application the name of the role is checked). It is not recommended to add any non user administrator permission to this role. For the case you want the same user to have e.g. 'user_admin' and 'trusted_user' rights, you could simply assign the user those two roles. It is always possible to create more roles.

Existing Permissions

Currently there are 35 permissions. There are 5 layers (project, faq, topic, question and answer) each with 7 different kinds of permissions. In the following, a '*' replaces these layers.
 
Name of the Permission Short Description
add_*:  This permission is required to add new entries, which do not have to be released by a moderator. The add_* permission overrides the corresponding add_unreleased_* permission. 
add_unreleased_*:  This permission is required to add new entries, which have to be released by a moderator before they are visible for everybody. 
modify_*:  With this permission it is possible to modify or delete any entry. 
modify_own_*:  With this permission it is possible to modify or delete those entries, which were created by him/herself. 
modify_own_unreleased_*:  With this permission it is possible to modify or delete those entries, which were created by him/herself and which are not yet released. 
see_unreleased_*:  With this permission it is possible to see the unreleased entries of the other users.
Remark: A user can always see his/her own unreleased entries. 
release_*:  This permission is required to release entries. With the release permission it is also possible to see all the unreleased entries. 

Administration of the Roles and Permissions

There are three different ways for administration of the Users, Roles and Permissions: The SQL insert Java generation scripts, the GUI of Turbine (which isn't quite finished yet) or working directly with the SQL shell. A forth method would be to install a package that allows you to modified the database via webpages. There are a few PHP based solutions out there.

SQL insert and Java based Generation

This is a good way to set up the permissions. Basically it means to edit three text files (jyve_users_roles, jyve_permissions_roles and header_jyve_access_rights run the GenerateRights.[sh | bat] script and run the resulting insert script (Generated_MySQL_Schema.sql) on your database. The reason why this is called Java based Generation is because there is a org/apache/jyve/util/GenerateRights.java file that is responsible for parsing the three files above and then generating the output file. The GenerateRights.[sh | bat] script is responsible for setting up the appropriate environment and arguments for execution of the Java class.

On Win32, you should use the .bat version of the file and on Unix you should use the .sh version of the file.

More information about the specifics of this can be found in the document INSTALL.txt.

Turbine GUI

Currently Turbine provides a GUI (Graphical User Interface), which is still under construction. I hope this work will be completed soon. The following features work already: The following features are not yet working (properly): The following features I have not tested: Currently the GUI is not yet linked from Jyve. To access the user administration features from Jyve you have to do the following:
  1. Login as a user to which the role of a 'user_admin' is assigned to. This presumes that you created such a user. If not, you could do this with the means described in the next section (SQL shell).
  2. Go to URL: http://<your host>:<your port>/<your servlet zone>/Turbine/screen/admin.PermissionEditor

  3. or
    http://<your host>:<your port>/<your servlet zone>/Turbine/screen/admin.RoleEditor
Good luck!

SQL shell commands

The most uncomfortable way for new users to make the user administration is through the Front end of your SQL server. In the following I describe how it works with MySQL. First I will give you an overview over the tables which exist for the user administration, then I will describe some examples of how to update your tables.

Tables in Jyve

With the MySQL command you can get a list of tables in your database:

mysql> show tables;

+----------------+
| Tables in Jyve |
+----------------+
| Permission     |
| RolePermission |
| UserRole       |
| Visitor        |
| VisitorRole    |
| answer         |
| faq            |
| project        |
| question       |
| topic          |
+----------------+

 
Table Name Description Project
Permission:  Maps the permission id's to permission names.  Turbine Table
RolePermission:  Maps the role id's to the permission id's.  Turbine Table
UserRole:  Maps the user id's to the role id's.  Turbine Table 
Visitor:  Contains the visitor information, such as name, email, etc. Here you can find also the visitor id.  Turbine Table 
VisitorRole:  Maps the visitor id's to the role id's  Turbine Table 
answer:  Contains the answers and related information.  Jyve Table
faq:  Contains the FAQ's and related information.  Jyve Table
project:  Contains the projects and related information.  Jyve Table
question:  Contains the questions and related information.  Jyve Table 
topic:  Contains the topics and related information.  Jyve Table 

SQL commands

The following some SQL statements can be used to perform the user administration directly in SQL:


Copyright (c) 2000 The Java Apache Project.
$Id: visitors_roles_permissions.html,v 1.2 2000/03/17 02:50:04 jonbolt Exp $
All rights reserved.