Backend Users and Groups

TODO: review these notes

Creating backend Users and Groups

This documentation should cover how to create backend groups and user accounts. Not every user will have the level of access to create users and/or groups. As they may not have need to do this work.

In order to create users and/groups, navigate to "Admin Area" in the lower left corner of the Web Engine, expand that and look for "Users" and "Groups".

ADMINISTRATORS: Groups that have the rights to create users, as well as groups that have a large amount of rights to sensitive information/areas, should be protected by 2 Factor Authentication (2FA) and require that the users assigned to those groups download an Authentication App such as Google Authenticator onto their mobile device. This is to prevent unauthorized access to the accounts that are able to add new users into the system.

Create a new user account

Note: As soon as a user account is created in Web Engine, the user will be emailed a Welcome E-Mail and a login link. Please consider this when creating the user accounts and assigning rights, if you have not yet trained the users.

1. Expand the "Admin Area" in the lower left corner of Web Engine
2. Click on the "Users" section
3. Click on the "Add user" button in the upper right corner of the screen
4. Name: provide the full name of the user
5. E-Mail: provide a working valid email address
6. Interface language: set to the appropriate language
7. Click on "Create" button
8. Repeat for other user accounts

At this point the user will be sent a link to set their password for Web Engine access. Once this is done, they will be able to login. If no groups have been assigned, they will only be able to see the Dashboard in the backend.

Trouble shooting

"An email is already in use"

• This means the user has an account somewhere in the system.
• To add them to a group, simply add their email, when trying to add a user to the group. The system should automatically find the user and you can assign the user to the group.

"Welcome email doesn't come in"

• First ask the user to check their E-Mail spam folder.
• If not in spam, send the URL for the backend login to the user and ask them to use the link "Forgot your password?" to request resetting their password.
• Send the user the link for this page.

Create a new user group

1. Access to the backend modules is controlled by user groups.
2. Backend user groups should be created in such a manner that user access can be controlled as granullarly as possible. Allowing users to access the system as they need to, but not accessing additional areas.
3. A person in the User Manager role, will only be able to grant access to what they can access.

Steps to create a backend user group:

1. Expand the "Admin Area" in the lower left corner of the Web Engine
2. Click on the "Groups" section
3. Verify a group with the rights you are seeking to grant, doesn't exist
4. Click on the "Add group" button in the upper right corner of the screen
5. Name: Provide the name of the group
6. Requires two-factor authentication (2FA): set a checkmark if this is a group that handles user accounts, or the group has access to sensitive areas or a lot of content
7. Click on "Create" button

Assigning Rights to a group: 

Once the Create button is clicked, the group will be saved and the group editing interface will be opened with the group name at the top. The Permissions tab should be selected.

1. Along the left side, under the Permissions tab, is a list of module access rights
2. Assign access rights determined by the purpose of the group
3. Create groups based on module access
4. Assign the minimum rights needed for the users to do their work

Some general guidelines for creating basic user groups follow.

WEB MODULE

Website Editors:

Web module: 

Site: always pick a website! (if a website is not explicitly chosen, the group can access all websites)

Sites: Basics

• Read
• Update
• Site's Categories
• Notifications

Pages:

• Read
• Create
• Update
• Delete

Menus:

• Read
• Create
• Update
• Delete

Redirects:

• Read
• Create
• Update
• Delete

Analytics:

• Read

Website Administrators:

Note: Website Administrators should have all the rights for the WEBSITE EDITORS group as a starting point.

Web module: 

Site: always pick a website. (if a website is not explicitly chosen, the group can access all websites)

Sites: Basics

• Read
• Update
• Site's Categories
• Notifications

Site: Advanced

• Appearance
• RSS

Pages:

• Read
• Create
• Update
• Delete
• Output Format

Menus:

• Read
• Create
• Update
• Delete

Redirects:

• Read
• Create
• Update
• Delete

Analytics:

• Read

USERS and GROUPS:

Note: What you assign for rights depends on what the users are allowed to do. For example you may only want to allow users to create Users, and assign Users to Groups, but not allow to create new groups. Users and Groups rights should only be given to a small sub-group of users for the entity.

User Manager group:

User:

• Read
• Create
• Update
• Delete

Groups:

• Read
• Update

ARTICLE WORKFLOWS:

Please see the documentation for Articles Module Setup Guide for details

COURSE MODULE USER ACCOUNTS SETUP

Please see the documentation for Course Module Setup Guide

MEDIA LIBRARY MODULE

Note: If there are multiple channels for the entity, then you need to decide if the group should be for a specific channel or for all channels of this entity. 

• If for a specific channel, assign the group a channel
• If group is for all channels, leave the channel blank. (If a Channel is not selected, the group can access all media libraries for the current entity)

Media Library Editors:

Channel: Select the specific channel

Channels:

• Read
• Create
• Update
• Delete

Shows:

• Read
• Create
• Update
• Delete

Episodes:

• Read
• Create
• Update
• Delete

Collections:

• Collections are displayed on both the website and in the Hope Channel App.
• Read
• Create
• Update
• Delete

Persons:

• Read
• Create
• Update
• Delete

Schedule:

• Read
• Create
• Update
• Delete

Media Library Managers:

Channel: Select the specific channel

This group should have the same basic rights as the Media Library Editors. Review the Editors rights and if they are too extensive assign them to the Administrator instead.

Channels

• Update