head	1.12;
access;
symbols
	TIGRIS_1_1_0RC2:1.3.2.1.4.2
	TIGRIS_1_1_0RC1:1.3.2.1.4.2
	TIGRIS_1_1:1.3.2.1.4.2.0.2
	TIGRIS_1_0_8:1.3.2.1.4.1
	TIGRIS_1_0_8RC3:1.3.2.1.4.1
	TIGRIS_1_0_8RC2:1.3.2.1.4.1
	TIGRIS_1_0_8RC1:1.3.2.1.4.1
	TIGRIS_1_0_7:1.3.2.1.4.1
	TIGRIS_1_0_7RC3:1.3.2.1.4.1
	TIGRIS_1_0_7RC2:1.3.2.1.4.1
	TIGRIS_1_0_7RC1:1.3.2.1.4.1
	TIGRIS_1_0_6:1.3.2.1.4.1
	TIGRIS_1_0_6RC5:1.3.2.1.4.1
	TIGRIS_1_0_6RC4:1.3.2.1.4.1
	TIGRIS_1_0_6RC3:1.3.2.1
	TIGRIS_1_0_6RC2:1.3.2.1
	TIGRIS_1_0_6RC1:1.3.2.1
	TIGRIS_1_0_5:1.3.2.1
	TIGRIS_1_0_5RC6:1.3.2.1
	TIGRIS_1_0_5RC5:1.3.2.1
	TIGRIS_1_0_5RC4:1.3.2.1
	TIGRIS_1_0_5RC3:1.3.2.1
	TIGRIS_1_0_5RC2:1.3.2.1
	TIGRIS_1_0_5RC1:1.3.2.1
	TIGRIS_1_0_4:1.3.2.1
	TIGRIS_1_0_3:1.3.2.1
	TIGRIS_1_0_2:1.3.2.1
	TIGRIS_1_0_1:1.3.2.1
	TIGRIS_1_0:1.3.2.1.0.4
	TIGRIS_1_0_0:1.3.2.1
	TIGRIS_1_0_0_RC1:1.3.0.2;
locks; strict;
comment	@# @;


1.12
date	2001.07.30.19.06.09;	author tberry;	state Exp;
branches;
next	1.11;

1.11
date	2001.07.24.18.59.35;	author tberry;	state Exp;
branches;
next	1.10;

1.10
date	2001.07.17.19.02.38;	author csjank;	state Exp;
branches;
next	1.9;

1.9
date	2001.06.21.07.07.40;	author jefflove;	state Exp;
branches;
next	1.8;

1.8
date	2001.06.20.02.07.15;	author lori;	state Exp;
branches;
next	1.7;

1.7
date	2001.06.11.03.14.33;	author jefflove;	state Exp;
branches;
next	1.6;

1.6
date	2001.05.03.20.56.14;	author lori;	state Exp;
branches;
next	1.5;

1.5
date	2001.04.17.23.26.23;	author tberry;	state Exp;
branches;
next	1.4;

1.4
date	2001.03.29.05.49.40;	author lori;	state Exp;
branches;
next	1.3;

1.3
date	2001.03.22.06.59.41;	author lori;	state Exp;
branches
	1.3.2.1;
next	1.2;

1.2
date	2001.03.08.07.30.03;	author lori;	state Exp;
branches;
next	1.1;

1.1
date	2001.03.07.00.13.36;	author lori;	state Exp;
branches;
next	;

1.3.2.1
date	2001.03.31.01.49.25;	author leonardr;	state Exp;
branches
	1.3.2.1.4.1;
next	;

1.3.2.1.4.1
date	2001.06.13.00.31.37;	author lori;	state Exp;
branches;
next	1.3.2.1.4.2;

1.3.2.1.4.2
date	2001.07.24.19.01.13;	author tberry;	state Exp;
branches
	1.3.2.1.4.2.2.1;
next	;

1.3.2.1.4.2.2.1
date	2001.08.23.19.08.48;	author tberry;	state Exp;
branches;
next	;


desc
@@


1.12
log
@added info for administring project level roles.  minor editing.
Issue number:
Obtained from:
Submitted by:
Reviewed by:
@
text
@ 
<div class="docs" id="domadminroles"> 
  <h2>Administering roles and permissions</h2>
  <div class="toc"> 
    <h3>Help for domain administration: Index</h3>
    <ul>
      <li> <a href="DomAdminOverview.html">Domain administration overview</a> 
        <ul>
          <li><a href="DomAdminAddUsers.html">Adding and editing user accounts</a></li>
          <li> <strong>You are here:</strong> Administering roles and permissions 
            <ul>
              <li><a href="#aboutroles">Understanding roles and permissions</a></li>
              <li><a href="#aboutroles"></a><a href="#userroles">Editing user 
                role assignments</a></li>
              <li><a href="#editroles">Editing roles</a></li>
              <li><a href="#addroles">Adding roles</a></li>
              <li><a href="#viewaddresources">About resources and actions</a></li>
            </ul>
          </li>
          <li><a href="DomAdminUserGroups.html">Creating and editing user groups</a></li>
          <li><a href="DomAdminProjectGroups.html">You are here: Creating and 
            editing project groups</a></li>
          <li><a href="DomAdminProjectApproval.html">Approving, disapproving, 
            or deferring projects</a></li>
          <li><a href="DomAdminAuditLogs.html">Using domain administration tools</a></li>
        </ul>
      </li>
    </ul>
  </div>
  <div class="courtesylinks"> 
    <p><a href="/servlets/HelpTOC">Back to main Help index</a></p>
  </div>
  <h3><a id="aboutroles" name="aboutroles">Understanding roles and permissions</a></h3>
  <p>Every user on this site is able to access features and conduct activities 
    based upon roles the user has been granted. There are two kinds of roles:</p>
  <ul>
    <li><b><i>Domain roles:</i></b> give users access to generalized information 
      and actions throughout the site. Domain Administrators assign and configure 
      domain roles to all users on this site. Every new user automatically gets 
      the "registered user" domain role by virtue of being registered on your 
      domain. It is also possible to create other domain roles; more about this 
      is covered in the <a href="#addroles">Adding roles</a> section of this document.</li>
    <li><b><i>Project roles:</i></b> limited to information and actions within 
      a project. Domain Administrators also can configure project roles, but by 
      design Project Owners usually assign project roles to users when they become 
      project members.</li>
  </ul>
  <p>Roles are either assigned to users through membership in a project, or through 
    association with project groups or user groups. All roles have a default set 
    of permissions associated with them. These permissions govern the users' ability 
    to conduct certain actions on this site.</p>
  <p>As Domain Administrator, you can:</p>
  <ul>
    <li>Use and assign existing roles.</li>
    <li>Alter existing roles by changing the permissions, actions, and/or resources 
      that are associated with them.</li>
    <li>Create entirely new roles and designate permissions for them. See <a href="#addroles">Adding 
      roles</a>.</li>
  </ul>
  <p>You can also tailor roles and permissions for sets of users by creating user 
    groups, and for sets of projects by making project groups. For more information 
    about this, see <a href="DomAdminProjectGroups.html">Creating and editing project 
    groups</a> and <a href="DomAdminUserGroups.html">Creating and editing user 
    groups</a>.</p>
  <h3><a id="userroles" name="userroles">Editing user role assignments</a></h3>
  <p>The fields and options in the bottom section of the <b>Edit User</b> page 
    enable you to view and change the individual user's role assignments.</p>
  <dl> 
    <dt>Group Memberships</dt>
    <dd>The user's affiliation with any user group or project categories in this 
      domain are listed here. User groups and project groups are created and configured 
      by you as the Domain Administrator. See <a href="DomAdminCategories.html">Creating 
      and editing project groups</a> and <a href="DomainAdminUserGroups.html">Creating 
      and editing user groups</a> for more information.</dd>
    <dt>Domain-wide Roles</dt>
    <dd>Domain roles assigned or conferred to the user are listed here. These 
      are generalized roles that permit the user to view site pages and conduct 
      site actions not associated with specific projects. See previous <a href="#aboutroles">Understanding 
      roles and permissions</a> section.</dd>
    <dt>Roles in domain's public projects</dt>
    <dd>Every public project hosted on this domain is automatically part of the 
      default project group labeled (not surprisingly) "All public projects." 
      Any roles the user holds in such projects are flagged here. See <a href="DomAdminProjectGroups.html">Creating 
      and editing project groups</a> for more information.</dd>
    <dt>Submit Changes</dt>
    <dd>This button submits any modifications to the individual user account made 
      in the fields above. Modifications to the user's roles are separate actions.</dd>
    <dt>Project Roles</dt>
    <dd>Roles the user holds that are associated with specific projects are listed 
      here, grouped by project name. Project names link to project home pages. 
      This list includes both open source and private, proprietary projects. See 
      <a href="#aboutroles">Understanding roles and permission</a> section for 
      a more comprehensive discussion of roles.</dd>
    <dt>Detailed Role Info</dt>
    <dd> These links lead to secondary screens with more detailed role information 
      associated with the current user: 
      <ul>
        <li><i>Direct and derived roles</i> displays two different sets roles 
          held by the user. <i>Direct roles</i> are those roles expressly assigned 
          to the user. For example, the user requested and was approved for a 
          certain role in a project. <i>Derived roles</i> are roles <i>conferred</i> 
          to this user because she/he is a member of a project specifically associated 
          with a project group's set of roles, or belongs to a user group assigned 
          a unique set of roles.</li>
        <li><i>Details of permissions</i> displays a screen rather unceremoniously 
          entitled <b>Permission Dump</b> because it tabulates literally every 
          single permission the user holds in your domain.</li>
      </ul>
      <p>Note that when individual users are part of particular project groups 
        or user groups, you can assign attributes and modify multiple user accounts 
        associated with those groups by using the <b>Project Group Edit</b> or 
        <b>User Group Edit</b> screens. See <a href="DomAdminCategories.html">Creating 
        and editing project groups</a> and <a href="DomainAdminUserGroups.html">Creating 
        and editing user groups</a> for more information.</p>
    </dd>
    <dt>Other operations: <i>Delete User</i></dt>
    <dd>This link removes the current user account. A confirmation message prompts 
      you for verification before this action is completed.</dd>
  </dl>
  <h3><a id="editroles" name="editroles">Editing roles</a></h3>
  <p>This site features a set of default roles that you may view using the <i>Administer 
    Roles</i> link in the "Admin Options" of your <b>Start Page</b>. This displays 
    the <b>Role List</b> page with all site roles listed as either domain or project-level. 
    A brief description of each role is included.</p>
  <p>To view a list of individual permissions associated with this role, click 
    on the role name link in the <b>Role List</b> page. Each permission listed 
    on the <b>Editing Role</b> page is characterized by both the site resource 
    and site action that it enables, i.e. "Project - Suggest" or "Version Control 
    - Update." The far right "Resource(s)" column defines in which site resources 
    each permission is effective. The default is for each permission to apply 
    to all available resources.</p>
  <p>As domain administrator, you have the option to modify this site's pre-packaged 
    roles by changing the permissions associated with them as needed. Placing 
    a check mark in the boxes next to a permission <i>removes this permission</i> 
    from the role.</p>
  <p>If you wish to <i>add</i> permissions to a role, click the <i>Add New Permission</i> 
    link at the top of the <b>Editing Role</b> page. This screen gives you a list 
    of all available permissions. To add permissions, place check marks in the 
    appropriate boxes.</p>
  <p>In addition to editing roles by adding and removing permissions, you can 
    modify or limit which resources the permissions associated with that role 
    will apply to. The resource section at the bottom of the <b>Add Permission 
    to Role</b> page lets you determine in which site resources to allocate the 
    role's new permissions.</p>
  <ul>
    <li>Selecting "All available resources .*" applies the selected permissions 
      for this role universally to all site resources available to this role, 
      including both web content and source code.</li>
    <li>Choosing "All web pages /www/.*" limits the selected permission for this 
      role specifically to web pages. This means the scope of these permissions 
      does not pertain to any source code level access, but only to web page content. 
      For example, assigning the "Version Control - Commit" permission to a role 
      and designating "All web pages /www/.*" as the resource results in users 
      with this role only being able to check out and commit web page content, 
      not project source code.</li>
  </ul>
  <p>After you have selected the permissions to add and determined the site resources 
    to apply these to, click the <b><i>Add Permissions</i></b> button at the bottom 
    of the page.</p>
  <p>See the section on <a href="#viewaddresources">Viewing and adding resources</a> 
    for more information about site resources.</p>
  <h3><a id="addroles" name="addroles">Adding roles</a></h3>
  <p>You have the option to create custom roles and assign the appropriate permissions 
    to them to meet the needs of your site and/or projects within your domain. 
    You should take some time to plan the scope of any new role you create before 
    beginning the creation process. You can create roles for the Host, Domain, 
    or Projects. Host roles enable ssociated user actions across all domains. 
    Domain roles enable associated user actions across the site. Project roles 
    enable associated user actions within the projects only. You can create roles 
    that are specific to one or more particular projects or associate the roles 
    across all projects.</p>
</div>
<ol>
  <li> 
    <div class="docs" id="domadminroles">To add new roles, select <b>Roles</b> 
      from the <b>Admin Options</b> menu to access the <b>Role List</b> page.</div>
  </li>
  <li> Click the "Add New Role" link in either the host, domain or project section. 
    Depending upon which link you click, this displays either the <b>Add Host 
    Role, Add Domain Role</b> or <b>Add Project Role</b> page. You can switch 
    between these pages using the links at the top of this page.</li>
  <li> Applies only to <b>Project Role</b> Select he visibility of the role. This 
    determines at what level the project role can be seen. Selecting the Host 
    level will make the role visible at all levels of the site. Selecting the 
    Domain level restricts the visibility to the domain and project level, while 
    the Project level will make the role only viewable at the project level. 
  <li>Enter a name and a description of the role. The role name can be up to 99 
    charactersin length and connot include a period (.). 
  <li>Select the level of functionality required for this role. Each functional 
    item controls the level of access for the role. 
    <ul>
      <li>The first item when checked prevents a user with this role in a project 
        to have the same role in subprojects. For example, when selected a user 
        with the Project Owner role in the "Games" project cannot have the Project 
        Owner role in the "Dominos" subproject. </li>
      <li>The second item, when selected, grants users with this role &quot;ownership&quot; 
        of functions within the project. Owners receive administrative email pertaining 
        to the function of which they have ownership.</li>
      <li>The third item, when selected, grants the role to users who create new 
        projects.</li>
      <li>The fourth item, when selected, makes the role requestable by users 
        on the site. If this item is not selected, the role must be assigned by 
        an administrator or a project owner.</li>
    </ul>
  <li> To assign permissions to the role you can either clone an existing role 
    by selecting a role from the drop down menu or you can assign specific permissions 
    to the role. To assign specific permissions, click the check box under the 
    <b>Add</b> field by the name of the permission you desire. 
  <li> 
    <p>Click the <b>Create Role</b> button. Use this feature with extreme caution! 
      Assigning permissions to roles may have security implications.</p>
  
</ol>
<div class="docs" id="domadminroles">
<h3><a id="viewaddresources" name="viewaddresources">About resources and actions</a></h3>
  <p><b><i>Resources</i></b> are all of the different elements used in this site 
    including tools, content, projects, and web pages. User roles and permissions 
    on this site are defined by the specific resources they apply to. For example, 
    each of these permissions -- "Mailing List - View," "Project - Suggest," "Version 
    Control - Commit" -- is comprised of a certain resource on this site and the 
    <b><i>action</i></b> being permitted within that resource. In these three 
    examples, the resources are, respectively: mailing list, project, and version 
    control.</p>
  <p>Resources are described on this site using regular expressions. Thus, the 
    pattern or regular expression meaning all available resources is ".*".</p>
  <p>You can view a complete list of all available resources on this site by clicking 
    the <i>Resource List</i> link at the top of the <b>Editing Role</b> page. 
    The default items in the Resource List page are "All available resources (.*)" 
    and "All web pages (/www/.*)". Clicking on the resource link displays the 
    <b>Edit Resource</b> screen where there is short, identifying description 
    and the pattern that represents the resource as a regular expression.</p>
  <p>As the domain administrator, you can also create new resources and define 
    them using the <i>Add New Resource</i> link at the top of the <b>Editing Role</b> 
    page. This is a powerful and flexible administrative feature. For example, 
    you might decide that you want to create new user roles with permissions that 
    only apply to certain types of files. If these were java files, you could 
    define that as a resource using the regular expression "*.java". Then you 
    could either create new roles or modify existing roles by adding permissions 
    defined with this "*.java" resource. Your newly created resource automatically 
    appears in the <b>Add Permission to Role</b> page. When you grant these roles 
    to users, their permissions are limited to java files only.</p>
  <div class="courtesylinks"> 
    <p><a href="DomAdminOverview.html">Back to Help for domain administration</a><br />
      <a href="/servlets/HelpTOC">Back to main Help index</a></p>
  </div>
</div>
 


@


1.11
log
@fixed broken links.
Issue number:
Obtained from:
Submitted by:
Reviewed by:
@
text
@d1 249
a249 226
 
<div class="docs" id="domadminroles"> 
  <h2>Administering roles and permissions</h2>
  <div class="toc"> 
    <h3>Help for domain administration: Index</h3>
    <ul>
      <li> <a href="DomAdminOverview.html">Domain administration overview</a> 
        <ul>
          <li><a href="DomAdminAddUsers.html">Adding and editing user accounts</a></li>
          <li> <strong>You are here:</strong> Administering roles and permissions 
            <ul>
              <li><a href="#aboutroles">Understanding roles and permissions</a></li>
              <li><a href="#aboutroles"></a><a href="#userroles">Editing user 
                role assignments</a></li>
              <li><a href="#editroles">Editing roles</a></li>
              <li><a href="#addroles">Adding roles</a></li>
              <li><a href="#viewaddresources">About resources and actions</a></li>
            </ul>
          </li>
          <li><a href="DomAdminUserGroups.html">Creating and editing user groups</a></li>
          <li><a href="DomAdminProjectGroups.html">You are here: Creating and 
            editing project groups</a></li>
          <li><a href="DomAdminProjectApproval.html">Approving, disapproving, 
            or deferring projects</a></li>
          <li><a href="DomAdminAuditLogs.html">Using domain administration tools</a></li>
        </ul>
      </li>
    </ul>
  </div>
  <div class="courtesylinks"> 
    <p><a href="/servlets/HelpTOC">Back to main Help index</a></p>
  </div>
  <h3><a id="aboutroles" name="aboutroles">Understanding roles and permissions</a></h3>
  <p>Every user on this site is able to access features and conduct activities 
    based upon roles the user has been granted. There are two kinds of roles:</p>
  <ul>
    <li><b><i>Domain roles</i></b> give users access to generalized information 
      and actions throughout the site. Domain Administrators assign and configure 
      domain roles to all users on this site. Every new user automatically gets 
      the "registered user" domain role by virtue of being registered on your 
      domain. It is also possible to create other domain roles; more about this 
      is covered in the <a href="#addroles">Adding roles</a> section of this document.</li>
    <li><b><i>Project roles</i></b> are limited to information and actions within 
      a project. Domain Administrators also can configure project roles, but by 
      design Project Owners usually assign project roles to users when they become 
      project members.</li>
  </ul>
  <p>Roles are either assigned to users through membership in a project, or through 
    association with project groups or user groups. All roles have a default set 
    of permissions associated with them. These permissions govern the users' ability 
    to conduct certain actions on this site.</p>
  <p>As Domain Administrator, you can:</p>
  <ul>
    <li>Use and assigning existing roles "as is."</li>
    <li>Alter existing roles by changing the permissions, actions, and/or resources 
      are associated with them.</li>
    <li>Create entirely new roles and designate permissions for them. (You cannot, 
      however, create new permissions.) See <a href="#addroles">Adding roles</a>.</li>
  </ul>
  <p>You can also tailor roles and permissions for sets of users by creating user 
    groups, and for sets of projects by making project groups. For more information 
    about this, see <a href="DomAdminProjectGroups.html">Creating and editing project 
    groups</a> and <a href="DomAdminUserGroups.html">Creating and editing user 
    groups</a>.</p>
  <h3><a id="userroles" name="userroles">Editing user role assignments</a></h3>
  <p>The fields and options in the bottom section of the <b>Edit User</b> page 
    enable you to view and change the individual user's role assignments.</p>
  <dl> 
    <dt>Group Memberships</dt>
    <dd>The user's affiliation with any user group or project categories in this 
      domain are listed here. User groups and project groups are created and configured 
      by you as the Domain Administrator. See <a href="DomAdminCategories.html">Creating 
      and editing project groups</a> and <a href="DomainAdminUserGroups.html">Creating 
      and editing user groups</a> for more information.</dd>
    <dt>Domain-wide Roles</dt>
    <dd>Domain roles assigned or conferred to the user are listed here. These 
      are generalized roles that permit the user to view site pages and conduct 
      site actions not associated with specific projects. See previous <a href="#aboutroles">Understanding 
      roles and permissions</a> section.</dd>
    <dt>Roles in domain's public projects</dt>
    <dd>Every public project hosted on this domain is automatically part of the 
      default project group labeled (not surprisingly) "All public projects." 
      Any roles the user holds in such projects are flagged here. See <a href="DomAdminProjectGroups.html">Creating 
      and editing project groups</a> for more information.</dd>
    <dt>Submit Changes</dt>
    <dd>This button submits any modifications to the individual user account made 
      in the fields above. Modifications to the user's roles are separate actions.</dd>
    <dt>Project Roles</dt>
    <dd>Roles the user holds that are associated with specific projects are listed 
      here, grouped by project name. Project names link to project home pages. 
      This list includes both open source and private, proprietary projects. See 
      <a href="#aboutroles">Understanding roles and permission</a> section for 
      a more comprehensive discussion of roles.</dd>
    <dt>Detailed Role Info</dt>
    <dd> These links lead to secondary screens with more detailed role information 
      associated with the current user: 
      <ul>
        <li><i>Direct and derived roles</i> displays two different sets roles 
          held by the user. <i>Direct roles</i> are those roles expressly assigned 
          to the user. For example, the user requested and was approved for a 
          certain role in a project. <i>Derived roles</i> are roles <i>conferred</i> 
          to this user because she/he is a member of a project specifically associated 
          with a project group's set of roles, or belongs to a user group assigned 
          a unique set of roles.</li>
        <li><i>Details of permissions</i> displays a screen rather unceremoniously 
          entitled <b>Permission Dump</b> because it tabulates literally every 
          single permission the user holds in your domain.</li>
      </ul>
      <p>Note that when individual users are part of particular project groups 
        or user groups, you can assign attributes and modify multiple user accounts 
        associated with those groups by using the <b>Project Group Edit</b> or 
        <b>User Group Edit</b> screens. See <a href="DomAdminCategories.html">Creating 
        and editing project groups</a> and <a href="DomainAdminUserGroups.html">Creating 
        and editing user groups</a> for more information.</p>
    </dd>
    <dt>Other operations: <i>Delete User</i></dt>
    <dd>This link removes the current user account. A confirmation message prompts 
      you for verification before this action is completed.</dd>
  </dl>
  <h3><a id="editroles" name="editroles">Editing roles</a></h3>
  <p>This site features a set of default roles that you may view using the <i>Administer 
    Roles</i> link in the "Admin Options" of your <b>Start Page</b>. This displays 
    the <b>Role List</b> page with all site roles listed as either domain or project-level. 
    A brief description of each role is included.</p>
  <p>To view a list of individual permissions associated with this role, click 
    on the role name link in the <b>Role List</b> page. Each permission listed 
    on the <b>Editing Role</b> page is characterized by both the site resource 
    and site action that it enables, i.e. "Project - Suggest" or "Version Control 
    - Update." The far right "Resource(s)" column defines in which site resources 
    each permission is effective. The default is for each permission to apply 
    to all available resources.</p>
  <p>As domain administrator, you have the option to modify this site's pre-packaged 
    roles by changing the permissions associated with them as needed. Placing 
    a check mark in the boxes next to a permission <i>removes this permission</i> 
    from the role.</p>
  <p>If you wish to <i>add</i> permissions to a role, click the <i>Add New Permission</i> 
    link at the top of the <b>Editing Role</b> page. This screen gives you a list 
    of all available permissions. To add permissions, place check marks in the 
    appropriate boxes.</p>
  <p>In addition to editing roles by adding and removing permissions, you can 
    modify or limit which resources the permissions associated with that role 
    will apply to. The resource section at the bottom of the <b>Add Permission 
    to Role</b> page lets you determine in which site resources to allocate the 
    role's new permissions.</p>
  <ul>
    <li>Selecting "All available resources .*" applies the selected permissions 
      for this role universally to all site resources available to this role, 
      including both web content and source code.</li>
    <li>Choosing "All web pages /www/.*" limits the selected permission for this 
      role specifically to web pages. This means the scope of these permissions 
      does not pertain to any source code level access, but only to web page content. 
      For example, assigning the "Version Control - Commit" permission to a role 
      and designating "All web pages /www/.*" as the resource results in users 
      with this role only being able to check out and commit web page content, 
      not project source code.</li>
  </ul>
  <p>After you have selected the permissions to add and determined the site resources 
    to apply these to, click the <b><i>Add Permissions</i></b> button at the bottom 
    of the page.</p>
  <p>See the section on <a href="#viewaddresources">Viewing and adding resources</a> 
    for more information about site resources.</p>
  <h3><a id="addroles" name="addroles">Adding roles</a></h3>
  <p>If your site has special requirements that none of the default roles meet, 
    you can create custom roles and assign the appropriate permissions to them. 
    You must determine what you want the scope of your newly created role to be. 
    You can create roles for Host, Domain, or Project. Host roles enable their 
    associated user actions across all domains. Domain roles enable their associated 
    user actions across the site. Project roles enable their associated user actions 
    within the project only.</p>
</div>
<ol>
  <li> 
    <div class="docs" id="domadminroles">To add new roles, navigate to the <b>Role 
      List</b> page.</div>
  </li>
  <li> 
    <div class="docs" id="domadminroles">Click the "Add New Role" link in either 
      the host, domain or project section. Depending upon which link you click, 
      this displays either the <b>Add Host Role, Add Domain Role</b> or <b>Add 
      Project Role</b> page. You can switch between these pages using the links 
      at the top of this page.</div>
  </li>
  <li> Enter all required fields and assign permissions either by cloning an existing 
    role or selecting permissions individually. The <b>Add Host Role, Add Domain 
    Role</b> and <b>Add Project Role</b> pages list all permissions/actions available 
    at that level. </li>
  <li>Click the <b>Create Role</b> button.</li>
</ol>
<div class="docs" id="domadminroles"> 
  <p> Use this feature with extreme caution! Assigning permissions to roles may 
    have security implications.</p>
  <h3><a id="viewaddresources" name="viewaddresources">About resources and actions</a></h3>
  <p><b><i>Resources</i></b> are all of the different elements used in this site 
    including tools, content, projects, and web pages. User roles and permissions 
    on this site are defined by the specific resources they apply to. For example, 
    each of these permissions -- "Mailing List - View," "Project - Suggest," "Version 
    Control - Commit" -- is comprised of a certain resource on this site and the 
    <b><i>action</i></b> being permitted within that resource. In these three 
    examples, the resources are, respectively: mailing list, project, and version 
    control.</p>
  <p>Resources are described on this site using regular expressions. Thus, the 
    pattern or regular expression meaning all available resources is ".*".</p>
  <p>You can view a complete list of all available resources on this site by clicking 
    the <i>Resource List</i> link at the top of the <b>Editing Role</b> page. 
    The default items in the Resource List page are "All available resources (.*)" 
    and "All web pages (/www/.*)". Clicking on the resource link displays the 
    <b>Edit Resource</b> screen where there is short, identifying description 
    and the pattern that represents the resource as a regular expression.</p>
  <p>As the domain administrator, you can also create new resources and define 
    them using the <i>Add New Resource</i> link at the top of the <b>Editing Role</b> 
    page. This is a powerful and flexible administrative feature. For example, 
    you might decide that you want to create new user roles with permissions that 
    only apply to certain types of files. If these were java files, you could 
    define that as a resource using the regular expression "*.java". Then you 
    could either create new roles or modify existing roles by adding permissions 
    defined with this "*.java" resource. Your newly created resource automatically 
    appears in the <b>Add Permission to Role</b> page. When you grant these roles 
    to users, their permissions are limited to java files only.</p>
  <div class="courtesylinks"> 
    <p><a href="DomAdminOverview.html">Back to Help for domain administration</a><br />
      <a href="/servlets/HelpTOC">Back to main Help index</a></p>
  </div>
</div>
 


@


1.10
log
@added info on adding roles per IZ3456
@
text
@d62 2
a63 2
    about this, see <a href="DomAdminCategories.html">Creating and editing project 
    groups</a> and <a href="DomainAdminUserGroups.html">Creating and editing user 
@


1.9
log
@html usage revision
@
text
@d1 4
a4 4
  <div class="docs" id="domadminroles">
   <h2>Administering roles and permissions</h2>

   <div class="toc">
a5 1

d7 1
a7 9
     <li>
      <a href="DomAdminOverview.html">Domain administration overview</a> 

      <ul>
       <li><a href="DomAdminAddUsers.html">Adding and editing user accounts</a></li>

       <li>
        <strong>You are here:</strong> Administering roles and permissions 

d9 17
a25 9
         <li><a href="#aboutroles">Understanding roles and permissions</a></li>

         <li><a href="#aboutroles"></a><a href="#userroles">Editing user role assignments</a></li>

         <li><a href="#editroles">Editing roles</a></li>

         <li><a href="#addroles">Adding roles</a></li>

         <li><a href="#viewaddresources">About resources and actions</a></li>
d27 1
a27 11
       </li>

       <li><a href="DomAdminUserGroups.html">Creating and editing user groups</a></li>

       <li><a href="DomAdminProjectGroups.html">You are here: Creating and editing project groups</a></li>

       <li><a href="DomAdminProjectApproval.html">Approving, disapproving, or deferring projects</a></li>

       <li><a href="DomAdminAuditLogs.html">Using domain administration tools</a></li>
      </ul>
     </li>
d29 2
a30 3
   </div>

   <div class="courtesylinks">
d32 22
a53 17
   </div>

   <h3><a id="aboutroles" name="aboutroles">Understanding roles and permissions</a></h3>

   <p>Every user on this site is able to access features and conduct activities based upon roles the user has been granted. There are two kinds of roles:</p>

   <ul>
    <li><b><i>Domain roles</i></b> give users access to generalized information and actions throughout the site. Domain Administrators assign and configure domain roles to all users on this site. Every new user automatically gets the "registered user" domain role by virtue of being registered on your domain. It is also possible to create other domain roles; more about this is covered in the <a href="#addroles">Adding roles</a> section of this document.</li>

    <li><b><i>Project roles</i></b> are limited to information and actions within a project. Domain Administrators also can configure project roles, but by design Project Owners usually assign project roles to users when they become project members.</li>
   </ul>

   <p>Roles are either assigned to users through membership in a project, or through association with project groups or user groups. All roles have a default set of permissions associated with them. These permissions govern the users' ability to conduct certain actions on this site.</p>

   <p>As Domain Administrator, you can:</p>

   <ul>
d55 14
a68 13

    <li>Alter existing roles by changing the permissions, actions, and/or resources are associated with them.</li>

    <li>Create entirely new roles and designate permissions for them. (You cannot, however, create new permissions.) See <a href="#addroles">Adding roles</a>.</li>
   </ul>

   <p>You can also tailor roles and permissions for sets of users by creating user groups, and for sets of projects by making project groups. For more information about this, see <a href="DomAdminCategories.html">Creating and editing project groups</a> and <a href="DomainAdminUserGroups.html">Creating and editing user groups</a>.</p>

   <h3><a id="userroles" name="userroles">Editing user role assignments</a></h3>

   <p>The fields and options in the bottom section of the <b>Edit User</b> page enable you to view and change the individual user's role assignments.</p>

   <dl>
d70 5
a74 3

    <dd>The user's affiliation with any user group or project categories in this domain are listed here. User groups and project groups are created and configured by you as the Domain Administrator. See <a href="DomAdminCategories.html">Creating and editing project groups</a> and <a href="DomainAdminUserGroups.html">Creating and editing user groups</a> for more information.</dd>

d76 4
a79 3

    <dd>Domain roles assigned or conferred to the user are listed here. These are generalized roles that permit the user to view site pages and conduct site actions not associated with specific projects. See previous <a href="#aboutroles">Understanding roles and permissions</a> section.</dd>

d81 4
a84 3

    <dd>Every public project hosted on this domain is automatically part of the default project group labeled (not surprisingly) "All public projects." Any roles the user holds in such projects are flagged here. See <a href="DomAdminProjectGroups.html">Creating and editing project groups</a> for more information.</dd>

d86 2
a87 3

    <dd>This button submits any modifications to the individual user account made in the fields above. Modifications to the user's roles are separate actions.</dd>

d89 5
a93 3

    <dd>Roles the user holds that are associated with specific projects are listed here, grouped by project name. Project names link to project home pages. This list includes both open source and private, proprietary projects. See <a href="#aboutroles">Understanding roles and permission</a> section for a more comprehensive discussion of roles.</dd>

d95 20
a114 11

    <dd>
     These links lead to secondary screens with more detailed role information associated with the current user: 

     <ul>
      <li><i>Direct and derived roles</i> displays two different sets roles held by the user. <i>Direct roles</i> are those roles expressly assigned to the user. For example, the user requested and was approved for a certain role in a project. <i>Derived roles</i> are roles <i>conferred</i> to this user because she/he is a member of a project specifically associated with a project group's set of roles, or belongs to a user group assigned a unique set of roles.</li>

      <li><i>Details of permissions</i> displays a screen rather unceremoniously entitled <b>Permission Dump</b> because it tabulates literally every single permission the user holds in your domain.</li>
     </ul>

     <p>Note that when individual users are part of particular project groups or user groups, you can assign attributes and modify multiple user accounts associated with those groups by using the <b>Project Group Edit</b> or <b>User Group Edit</b> screens. See <a href="DomAdminCategories.html">Creating and editing project groups</a> and <a href="DomainAdminUserGroups.html">Creating and editing user groups</a> for more information.</p>
a115 1

d117 103
a219 45

    <dd>This link removes the current user account. A confirmation message prompts you for verification before this action is completed.</dd>
   </dl>

   <h3><a id="editroles" name="editroles">Editing roles</a></h3>

   <p>This site features a set of default roles that you may view using the <i>Administer Roles</i> link in the "Admin Options" of your <b>Start Page</b>. This displays the <b>Role List</b> page with all site roles listed as either domain or project-level. A brief description of each role is included.</p>

   <p>To view a list of individual permissions associated with this role, click on the role name link in the <b>Role List</b> page. Each permission listed on the <b>Editing Role</b> page is characterized by both the site resource and site action that it enables, i.e. "Project - Suggest" or "Version Control - Update." The far right "Resource(s)" column defines in which site resources each permission is effective. The default is for each permission to apply to all available resources.</p>

   <p>As domain administrator, you have the option to modify this site's pre-packaged roles by changing the permissions associated with them as needed. Placing a check mark in the boxes next to a permission <i>removes this permission</i> from the role.</p>

   <p>If you wish to <i>add</i> permissions to a role, click the <i>Add New Permission</i> link at the top of the <b>Editing Role</b> page. This screen gives you a list of all available permissions. To add permissions, place check marks in the appropriate boxes.</p>

   <p>In addition to editing roles by adding and removing permissions, you can modify or limit which resources the permissions associated with that role will apply to. The resource section at the bottom of the <b>Add Permission to Role</b> page lets you determine in which site resources to allocate the role's new permissions.</p>

   <ul>
    <li>Selecting "All available resources .*" applies the selected permissions for this role universally to all site resources available to this role, including both web content and source code.</li>

    <li>Choosing "All web pages /www/.*" limits the selected permission for this role specifically to web pages. This means the scope of these permissions does not pertain to any source code level access, but only to web page content. For example, assigning the "Version Control - Commit" permission to a role and designating "All web pages /www/.*" as the resource results in users with this role only being able to check out and commit web page content, not project source code.</li>
   </ul>

   <p>After you have selected the permissions to add and determined the site resources to apply these to, click the <b><i>Add Permissions</i></b> button at the bottom of the page.</p>

   <p>See the section on <a href="#viewaddresources">Viewing and adding resources</a> for more information about site resources.</p>

   <h3><a id="addroles" name="addroles">Adding roles</a></h3>

   <p>If your site has special requirements that none of the default roles meet, you can also create custom roles and assign the appropriate permissions to them. To do this, in the <b>Role List</b> page click the "Add New Role" link in either the domain or project section, depending upon the type of role you want to create. Depending upon which one you click, this displays either the <b>Add Domain Role</b> or <b>Add Project Role</b> page. You can switch between these pages using the links at the top of this page.</p>

   <p>You must determine what you want the scope of your newly created role to be. If you want to create a role that enables certain user actions universally across the site, add the new role as a domain role. If you want to create a role with permissions that are <i>not</i> universally enabled across this site, you should add the new role as a project role. When project roles are assigned, their associated permissions are granted to the user only within that project.</p>

   <p>The <b>Add Domain Role</b> and <b>Add Project Role</b> pages list every permission/action available at that level. Use this feature with extreme caution! Assigning permissions to roles may have security implications.</p>

   <h3><a id="viewaddresources" name="viewaddresources">About resources and actions</a></h3>

   <p><b><i>Resources</i></b> are all of the different elements used in this site including tools, content, projects, and web pages. User roles and permissions on this site are defined by the specific resources they apply to. For example, each of these permissions -- "Mailing List - View," "Project - Suggest," "Version Control - Commit" -- is comprised of a certain resource on this site and the <b><i>action</i></b> being permitted within that resource. In these three examples, the resources are, respectively: mailing list, project, and version control.</p>

   <p>Resources are described on this site using regular expressions. Thus, the pattern or regular expression meaning all available resources is ".*".</p>

   <p>You can view a complete list of all available resources on this site by clicking the <i>Resource List</i> link at the top of the <b>Editing Role</b> page. The default items in the Resource List page are "All available resources (.*)" and "All web pages (/www/.*)". Clicking on the resource link displays the <b>Edit Resource</b> screen where there is short, identifying description and the pattern that represents the resource as a regular expression.</p>

   <p>As the domain administrator, you can also create new resources and define them using the <i>Add New Resource</i> link at the top of the <b>Editing Role</b> page. This is a powerful and flexible administrative feature. For example, you might decide that you want to create new user roles with permissions that only apply to certain types of files. If these were java files, you could define that as a resource using the regular expression "*.java". Then you could either create new roles or modify existing roles by adding permissions defined with this "*.java" resource. Your newly created resource automatically appears in the <b>Add Permission to Role</b> page. When you grant these roles to users, their permissions are limited to java files only.</p>

   <div class="courtesylinks">
d221 1
a221 2
    <a href="/servlets/HelpTOC">Back to main Help index</a></p>
   </div>
d223 1
@


1.8
log
@added explanatory info about marking newly created role as owner; resolves issue 3637
@
text
@d1 2
a2 15
<!DOCTYPE html PUBLIC "-//CollabNet//DTD XHTML 1.0 Transitional//EN"
"http://collabnet.com/dtds/collabnet_transitional_10.dtd">
<html>
 <head>
  <title>Administering roles and permissions</title>
<style type="text/css">
 dt.c3 {font-weight: bold}
 dt.c2 {font-style: italic; font-weight: bold}
 div.c1 {margin-left: 2em}
</style>
 </head>

 <body>
  <div class="docs" id="docid">
<h2>Administering roles and permissions</h2> 
d4 2
a5 1
  <p><b>Help for domain administration: Index</b></p>
d7 3
a9 3
  <div>
   <dl>
    <dt><a href="DomAdminOverview.html">Domain administration overview</a></dt>
d11 2
a12 1
    <dd><a href="DomAdminAddUsers.html">Adding and editing user accounts</a></dd>
d14 2
a15 2
    <dd>
     <b>You are here: Administering roles and permissions</b>
d17 2
a18 2
     <ul>
      <li><b><a href="#aboutroles">Understanding roles and permissions</a></b></li>
d20 1
a20 1
      <li><b><a href="#aboutroles"></a><a href="#userroles">Editing user role assignments</a></b></li>
d22 1
a22 1
      <li><b><a href="#editroles">Editing roles</a></b></li>
d24 1
a24 1
      <li><b><a href="#addroles">Adding roles</a></b></li>
d26 3
a28 3
      <li><b><a href="#viewaddresources">About resources and actions</a></b></li>
     </ul>
    </dd>
d30 1
a30 1
    <dd><a href="DomAdminUserGroups.html">Creating and editing user groups</a></dd>
d32 1
a32 1
    <dd><a href="DomAdminProjectGroups.html">Creating and editing project groups</a></dd>
d34 1
a34 1
    <dd><a href="DomAdminProjectApproval.html">Approving, disapproving, or deferring projects</a></dd>
d36 5
a40 1
    <dd><a href="DomAdminAuditLogs.html">Using domain administration tools</a></dd>
d42 3
a44 3
    <dt><a href="/servlets/HelpTOC">Back to main Help index</a></dt>
   </dl>
  </div>
d46 1
a46 3
  
  
  <h3><a id="aboutroles" name="aboutroles">Understanding roles and permissions</a></h3> 
d48 1
a48 1
  <p>Every user on this site is able to access features and conduct activities based upon roles the user has been granted. There are two kinds of roles:</p>
d50 2
a51 2
  <ul>
   <li><b><i>Domain roles</i></b> give users access to generalized information and actions throughout the site. Domain Administrators assign and configure domain roles to all users on this site. Every new user automatically gets the "registered user" domain role by virtue of being registered on your domain. It is also possible to create other domain roles; more about this is covered in the <a href="#addroles">Adding roles</a> section of this document.</li>
d53 2
a54 2
   <li><b><i>Project roles</i></b> are limited to information and actions within a project. Domain Administrators also can configure project roles, but by design Project Owners usually assign project roles to users when they become project members.</li>
  </ul>
d56 1
a56 1
  <p>Roles are either assigned to users through membership in a project, or through association with project groups or user groups. All roles have a default set of permissions associated with them. These permissions govern the users' ability to conduct certain actions on this site.</p>
d58 1
a58 1
  <p>As Domain Administrator, you can:</p>
d60 2
a61 2
  <ul>
   <li>Use and assigning existing roles "as is."</li>
d63 1
a63 1
   <li>Alter existing roles by changing the permissions, actions, and/or resources are associated with them.</li>
d65 2
a66 2
   <li>Create entirely new roles and designate permissions for them. (You cannot, however, create new permissions.) See <a href="#addroles">Adding roles</a>.</li>
  </ul>
d68 1
a68 1
  <p>You can also tailor roles and permissions for sets of users by creating user groups, and for sets of projects by making project groups. For more information about this, see <a href="DomAdminCategories.html">Creating and editing project groups</a> and <a href="DomainAdminUserGroups.html">Creating and editing user groups</a>.</p>
d70 1
a70 3
  
  
  <h3><a id="userroles" name="userroles">Editing user role assignments</a></h3> 
d72 1
a72 1
  <p>The fields and options in the bottom section of the <b>Edit User</b> page enable you to view and change the individual user's role assignments.</p>
d74 2
a75 2
  <dl>
   <dt class="c2">Group Memberships</dt>
d77 1
a77 2
   <dd>The user's affiliation with any user group or project categories in this domain are listed here. User groups and project groups are created and configured by you as the Domain Administrator. See <a href="DomAdminCategories.html">Creating and editing project groups</a> and <a href="DomainAdminUserGroups.html">Creating and editing user groups</a> for more information.</dd>
  </dl>
d79 1
a79 2
  <dl>
   <dt class="c2">Domain-wide Roles</dt>
d81 1
a81 2
   <dd>Domain roles assigned or conferred to the user are listed here. These are generalized roles that permit the user to view site pages and conduct site actions not associated with specific projects. See previous <a href="#aboutroles">Understanding roles and permissions</a> section.</dd>
  </dl>
d83 1
a83 2
  <dl>
   <dt class="c2">Roles in domain's public projects</dt>
d85 1
a85 2
   <dd>Every public project hosted on this domain is automatically part of the default project group labeled (not surprisingly) "All public projects." Any roles the user holds in such projects are flagged here. See <a href="DomAdminProjectGroups.html">Creating and editing project groups</a> for more information.</dd>
  </dl>
d87 1
a87 2
  <dl>
   <dt class="c2">Submit Changes</dt>
d89 1
a89 2
   <dd>This button submits any modifications to the individual user account made in the fields above. Modifications to the user's roles are separate actions.</dd>
  </dl>
d91 1
a91 2
  <dl>
   <dt class="c2">Project Roles</dt>
d93 1
a93 2
   <dd>Roles the user holds that are associated with specific projects are listed here, grouped by project name. Project names link to project home pages. This list includes both open source and private, proprietary projects. See <a href="#aboutroles">Understanding roles and permission</a> section for a more comprehensive discussion of roles.</dd>
  </dl>
d95 1
a95 2
  <dl>
   <dt class="c2">Detailed Role Info</dt>
d97 2
a98 2
   <dd>These links lead to secondary screens with more detailed role information associated with the current user:</dd>
  </dl>
d100 2
a101 1
  
d103 2
a104 3
  <ul>
   <li>
    <i>Direct and derived roles</i> displays two different sets roles held by the user. <i>Direct roles</i> are those roles expressly assigned to the user. For example, the user requested and was approved for a certain role in a project. <i>Derived roles</i> are roles <i>conferred</i> to this user because she/he is a member of a project specifically associated with a project group's set of roles, or belongs to a user group assigned a unique set of roles. 
d106 2
a107 2
    
   </li>
d109 1
a109 2
   <li><i>Details of permissions</i> displays a screen rather unceremoniously entitled <b>Permission Dump</b> because it tabulates literally every single permission the user holds in your domain.</li>
  </ul>
d111 2
a112 1
  
d114 1
a114 3
  <dl>
   <dd>Note that when individual users are part of particular project groups or user groups, you can assign attributes and modify multiple user accounts associated with those groups by using the <b>Project Group Edit</b> or <b>User Group Edit</b> screens. See <a href="DomAdminCategories.html">Creating and editing project groups</a> and <a href="DomainAdminUserGroups.html">Creating and editing user groups</a> for more information.</dd>
  </dl>
d116 1
a116 1
  
d118 1
a118 2
  <dl>
   <dt class="c3">Other operations: <i>Delete User</i></dt>
d120 1
a120 2
   <dd>This link removes the current user account. A confirmation message prompts you for verification before this action is completed.</dd>
  </dl>
d122 1
a122 3
  
  
  <h3><a id="editroles" name="editroles">Editing roles</a></h3> 
d124 1
a124 1
  <p>This site features a set of default roles that you may view using the <i>Administer Roles</i> link in the "Admin Options" of your <b>Start Page</b>. This displays the <b>Role List</b> page with all site roles listed as either domain or project-level. A brief description of each role is included.</p>
d126 2
a127 1
  <p>To view a list of individual permissions associated with this role, click on the role name link in the <b>Role List</b> page. Each permission listed on the <b>Editing Role</b> page is characterized by both the site resource and site action that it enables, i.e. "Project - Suggest" or "Version Control - Update." The far right "Resource(s)" column defines in which site resources each permission is effective. The default is for each permission to apply to all available resources.</p>
d129 2
a130 1
  <p>As domain administrator, you have the option to modify this site's pre-packaged roles by changing the permissions associated with them as needed. Placing a check mark in the boxes next to a permission <i>removes this permission</i> from the role.</p>
d132 1
a132 1
  <p>If you wish to <i>add</i> permissions to a role, click the <i>Add New Permission</i> link at the top of the <b>Editing Role</b> page. This screen gives you a list of all available permissions. To add permissions, place check marks in the appropriate boxes.</p>
d134 1
a134 1
  <p>In addition to editing roles by adding and removing permissions, you can modify or limit which resources the permissions associated with that role will apply to. The resource section at the bottom of the <b>Add Permission to Role</b> page lets you determine in which site resources to allocate the role's new permissions.</p>
d136 1
a136 2
  <ul>
   <li>Selecting "All available resources .*" applies the selected permissions for this role universally to all site resources available to this role, including both web content and source code.</li>
d138 1
a138 2
   <li>Choosing "All web pages /www/.*" limits the selected permission for this role specifically to web pages. This means the scope of these permissions does not pertain to any source code level access, but only to web page content. For example, assigning the "Version Control - Commit" permission to a role and designating "All web pages /www/.*" as the resource results in users with this role only being able to check out and commit web page content, not project source code.</li>
  </ul>
d140 1
a140 1
  <p>After you have selected the permissions to add and determined the site resources to apply these to, click the <b><i>Add Permissions</i></b> button at the bottom of the page.</p>
d142 1
a142 1
  <p>See the section on <a href="#viewaddresources">Viewing and adding resources</a> for more information about site resources.</p>
d144 1
a144 3
  
  
  <h3><a id="addroles" name="addroles">Adding roles</a></h3> 
d146 1
a146 1
  <p>If your site has special requirements that none of the default roles meet, you can also create custom roles and assign the appropriate permissions to them. To do this, in the <b>Role List</b> page click the "Add New Role" link in either the domain or project section, depending upon the type of role you want to create. Depending upon which one you click, this displays either the <b>Add Domain Role</b> or <b>Add Project Role</b> page. You can switch between these pages using the links at the top of this page.</p>
d148 1
a148 1
  <p>You must determine what you want the scope of your newly created role to be. If you want to create a role that enables certain user actions universally across the site, add the new role as a domain role. If you want to create a role with permissions that are <i>not</i> universally enabled across this site, you should add the new role as a project role. When project roles are assigned, their associated permissions are granted to the user only within that project.</p>
d150 1
a150 9
<ul>
<li>Checking "Allow users to request this role?" will cause the new role to appe
ar in the membership request screen for projects.</li>
<p>
<li>Checking "Should someone with this role be considered an 'owner' of the asso
ciated project?" confers additional project administrative responsibilities as p
art of the new role, such as receiving and responding to automated email message
s generated by project activity.
</ul>
d152 1
a152 1
  <p>The <b>Add Domain Role</b> and <b>Add Project Role</b> pages also list every permission/action available at that level. Use this feature with extreme caution! Assigning permissions to roles may have security implications.</p>
d154 6
a159 19
  
  
  <h3><a id="viewaddresources" name="viewaddresources">About resources and actions</a></h3> 

  <p><b><i>Resources</i></b> are all of the different elements used in this site including tools, content, projects, and web pages. User roles and permissions on this site are defined by the specific resources they apply to. For example, each of these permissions -- "Mailing List - View," "Project - Suggest," "Version Control - Commit" -- is comprised of a certain resource on this site and the <b><i>action</i></b> being permitted within that resource. In these three examples, the resources are, respectively: mailing list, project, and version control.</p>

  <p>Resources are described on this site using regular expressions. Thus, the pattern or regular expression meaning all available resources is ".*".</p>

  <p>You can view a complete list of all available resources on this site by clicking the <i>Resource List</i> link at the top of the <b>Editing Role</b> page. The default items in the Resource List page are "All available resources (.*)" and "All web pages (/www/.*)". Clicking on the resource link displays the <b>Edit Resource</b> screen where there is short, identifying description and the pattern that represents the resource as a regular expression.</p>

  <p>As the domain administrator, you can also create new resources and define them using the <i>Add New Resource</i> link at the top of the <b>Editing Role</b> page. This is a powerful and flexible administrative feature. For example, you might decide that you want to create new user roles with permissions that only apply to certain types of files. If these were java files, you could define that as a resource using the regular expression "*.java". Then you could either create new roles or modify existing roles by adding permissions defined with this "*.java" resource. Your newly created resource automatically appears in the <b>Add Permission to Role</b> page. When you grant these roles to users, their permissions are limited to java files only.</p>

  
  
 <div class="courtesylinks"> <a href="DomAdminOverview.html">Back to Help for domain administration</a><br />
<a href="/servlets/HelpTOC">Back to main Help index</a></div> 
 </div>
</body>
</html>
@


1.7
log
@extensive markup rework - first pass toward house xhtmlification
@
text
@d179 11
a189 1
  <p>The <b>Add Domain Role</b> and <b>Add Project Role</b> pages list every permission/action available at that level. Use this feature with extreme caution! Assigning permissions to roles may have security implications.</p>
@


1.6
log
@removed referenced links to project quotas and hosted db help docs in index; changed reference to title of DomAdminAuditLogs.html doc
@
text
@d1 2
d4 8
a11 1
<head>
d13 3
a15 1
<title>Administering roles and permissions</title>
d17 1
a17 141
</head>
<body>
<span class="Header">Administering roles and permissions</span>
<p>
<span class="PlainText"><b>Help for domain administration: Index</b>
<p>
<ul>
	<dl>
	<dt><a href="DomAdminOverview.html">Domain administration overview</a>
		<dd><a href="DomAdminAddUsers.html">Adding and editing user accounts</a>
		<dd><b>You are here: Administering roles and permissions
			<ul>
			<li><a href="#aboutroles">Understanding roles and permissions
			</a><li><a href="#aboutroles"></a><a href="#userroles">Editing user role assignments</a>
			<li><a href="#editroles">Editing roles</a>
			<li><a href="#addroles">Adding roles</a>
			<li><a href="#viewaddresources">About resources and actions</a>
			</ul></b>
		<dd><a href="DomAdminUserGroups.html">Creating and editing user groups</a>
		<dd><a href="DomAdminProjectGroups.html">Creating and editing project groups</a>
		<dd><a href="DomAdminProjectApproval.html">Approving, disapproving, or deferring projects</a>
		<dd><a href="DomAdminAuditLogs.html">Using domain administration tools</a>
    <dt><a href="/servlets/HelpTOC">Back to main Help index</a>
	</dl>
</ul>
<p>


<hr noshade size=1>
<a name="aboutroles"></a><span class="InputHeader">Understanding roles and permissions</span>
<p>
Every user on this site is able to access features and conduct activities based upon roles the user has been granted. There are two kinds of roles:
<ul>
<li><b><i>Domain roles</i></b> give users access to generalized information and actions throughout the site. Domain Administrators assign and configure domain roles to all users on this site. Every new user automatically gets the "registered user" domain role by virtue of being registered on your domain. It is also possible to create other domain roles; more about this is covered in the <a href="#addroles">Adding roles</a> section of this document.
<p>
<li><b><i>Project roles</i></b> are limited to information and actions within a project. Domain Administrators also can configure project roles, but by design Project Owners usually assign project roles to users when they become project members.
</ul>
<p>
Roles are either assigned to users through membership in a project, or through association with project groups or user groups. All roles have a default set of permissions associated with them. These permissions govern the users' ability to conduct certain actions on this site. 
<p>
As Domain Administrator, you can:
<ul>
<li>Use and assigning existing roles "as is."
<p>
<li>Alter existing roles by changing the permissions, actions, and/or resources are associated with them.
<p>
<li>Create entirely new roles and designate permissions for them. (You cannot, however, create new permissions.) See <a href="#addroles">Adding roles</a>.
</ul>
<p>
You can also tailor roles and permissions for sets of users by creating user groups, and for sets of projects by making project groups. For more information about this, see <a href="DomAdminCategories.html">Creating and editing project groups</a> and <a href="DomainAdminUserGroups.html">Creating and editing user groups</a>.
<p>

<hr noshade size=1>
<a name="userroles"></a><span class="InputHeader">Editing user role assignments</span>
<p>
The fields and options in the bottom section of the <b>Edit User</b> page enable you to view and change the individual user's role assignments.
<p>
<dt><b><i>Group Memberships</i></b>
	<dd>The user's affiliation with any user group or project categories in this domain are listed here. User groups and project groups are created and configured by you as the Domain Administrator. See <a href="DomAdminCategories.html">Creating and editing project groups</a> and <a href="DomainAdminUserGroups.html">Creating and editing user groups</a> for more information.
<p>
<dt><b><i>Domain-wide Roles</i></b>
	<dd>Domain roles assigned or conferred to the user are listed here. These are generalized roles that permit the user to view site pages and conduct site actions not associated with specific projects. See previous  <a href="#aboutroles">Understanding roles and permissions</a> section. 
<p>
<dt>
<b><i>Roles in domain's public projects</i></b>
	<dd>Every public project hosted on this domain is automatically part of the default project group labeled (not surprisingly) "All public projects." Any roles the user holds in such projects are flagged here. See <a href="DomAdminProjectGroups.html">Creating and editing project groups</a> for more information.
	<p>
<dt><b><i>Submit Changes</i></b>
	<dd>This button submits any modifications to the individual user account made in the fields above. Modifications to the user's roles are separate actions.
	<p>
<dt><b><i>Project Roles</i></b>
	<dd>Roles the user holds that are associated with specific projects are listed here, grouped by project name. Project names link to project home pages. This list includes both open source and private, proprietary projects. See <a href="#aboutroles">Understanding roles and permission</a> section for a more comprehensive discussion of roles.
<p>
<dt><b><i>Detailed Role Info</i></b>
	<dd>These links lead to secondary screens with more detailed role information associated with the current user:
	<p>
		<ul>
		<li><i>Direct and derived roles</i> displays two different sets roles held by the user. <i>Direct roles</i> are those roles expressly assigned to the user. For example, the user requested and was approved for a certain role in a project. <i>Derived roles</i> are roles <i>conferred</i> to this user because she/he is a member of a project specifically associated with a project group's set of roles, or belongs to a user group assigned a unique set of roles.
		<p>
		<li><i>Details of permissions</i> displays a screen rather unceremoniously entitled <b>Permission Dump</b> because it tabulates literally every single permission the user holds in your domain.
		</ul>
		<p>
	<dd>Note that when individual users are part of particular project groups or user groups, you can assign attributes and modify multiple user accounts associated with those groups by using the <b>Project Group Edit</b> or <b>User Group Edit</b> screens. See <a href="DomAdminCategories.html">Creating and editing project groups</a> and <a href="DomainAdminUserGroups.html">Creating and editing user groups</a> for more information.
<p>

<dt><b>Other operations: <i>Delete User</i></b>
	<dd>This link removes the current user account. A confirmation message prompts you for verification before this action is completed.

<p>


<hr noshade size=1>
<a name="editroles"></a><span class="InputHeader">Editing roles</span>
<p>
This site features a set of default roles that you may view using the <i>Administer Roles</i> link in the "Admin Options" of your <b>Start Page</b>. This displays the <b>Role List</b> page with all site roles listed as either domain or project-level. A brief description of each role is included.
<p>
To view a list of individual permissions associated with this role, click on the role name link in the <b>Role List</b> page. Each permission listed on the <b>Editing Role</b> page is characterized by both the site resource and site action that it enables, i.e. "Project - Suggest" or "Version Control - Update." The far right "Resource(s)" column defines in which site resources each permission is effective. The default is for each permission to apply to all available resources.
<p>
As domain administrator, you have the option to modify this site's pre-packaged roles by changing the permissions associated with them as needed. Placing a check mark in the boxes next to a permission <i>removes this permission</i> from the role.
<p>
If you wish to <i>add</i> permissions to a role, click the <i>Add New Permission</i> link at the top of the <b>Editing Role</b> page. This screen gives you a list of all available permissions. To add permissions, place check marks in the appropriate boxes.
<p>
In addition to editing roles by adding and removing permissions, you can modify or limit which resources the permissions associated with that role will apply to. The resource section at the bottom of the <b>Add Permission to Role</b> page lets you determine in which site resources to allocate the role's new permissions.
<p>
<ul>
<li>Selecting "All available resources .*" applies the selected permissions for this role universally to all site resources available to this role, including both web content and source code.
<p>
<li>Choosing "All web pages /www/.*" limits the selected permission for this role specifically to web pages. This means the scope of these permissions does not pertain to any source code level access, but only to web page content. For example, assigning the "Version Control - Commit" permission to a role and designating "All web pages /www/.*" as the resource results in users with this role only being able to check out and commit web page content, not project source code.
</ul>
After you have selected the permissions to add and determined the site resources to apply these to, click the <b><i>Add Permissions</i></b> button at the bottom of the page.
<p>
See the section on <a href="#viewaddresources">Viewing and adding resources</a> for more information about site resources. 
<p>

<hr noshade size=1>
<a name="addroles"></a><span class="InputHeader">Adding roles</span>
<p>
If your site has special requirements that none of the default roles meet, you can also create custom roles and assign the appropriate permissions to them. To do this, in the <b>Role List</b> page click the "Add New Role" link in either the domain or project section, depending upon the type of role you want to create. Depending upon which one you click, this displays either the <b>Add Domain Role</b> or <b>Add Project Role</b> page. You can switch between these pages using the links at the top of this page.
<p>
You must determine what you want the scope of your newly created role to be. If you want to create a role that enables certain user actions universally across the site, add the new role as a domain role. If you want to create a role with permissions that are <i>not</i> universally enabled across this site, you should add the new role as a project role. When project roles are assigned, their associated permissions are granted to the user only within that project.
<p>
The <b>Add Domain Role</b> and <b>Add Project Role</b> pages list every permission/action available at that level. Use this feature with extreme caution! Assigning permissions to roles may have security implications.
<p>


<hr noshade size=1>
<a name="viewaddresources"></a><span class="InputHeader">About resources and actions</span>
<p>
<b><i>Resources</i></b> are all of the different elements used in this site including tools, content, projects, and web pages. User roles and permissions on this site are defined by the specific resources they apply to. For example, each of these permissions -- "Mailing List - View," "Project - Suggest," "Version Control - Commit" -- is comprised of a certain resource on this site and the <b><i>action</i></b> being permitted within that resource. In these three examples, the resources are, respectively: mailing list, project, and version control.
<p>
Resources are described on this site using regular expressions. Thus, the pattern or regular expression meaning all available resources is ".*".
<p>
You can view a complete list of all available resources on this site by clicking the <i>Resource List</i> link at the top of the <b>Editing Role</b> page. The default items in the Resource List page are "All available resources (.*)" and "All web pages (/www/.*)".  Clicking on the resource link displays the <b>Edit Resource</b> screen where there is short, identifying description and the pattern that represents the resource as a regular expression.
<p>
As the domain administrator, you can also create new resources and define them using the <i>Add New Resource</i> link at the top of the <b>Editing Role</b> page. This is a powerful and flexible administrative feature. For example, you might decide that you want to create new user roles with permissions that only apply to certain types of files. If these were java files, you could define that as a resource using the regular expression "*.java". Then you could either create new roles or modify existing roles by adding permissions defined with this "*.java" resource. Your newly created resource automatically appears in the <b>Add Permission to Role</b> page. When you grant these roles to users, their permissions are limited to java files only.
<p>

<hr noshade size=1>
<a href="DomAdminOverview.html">Back to Help for domain administration</a><br>
<a href="/servlets/HelpTOC">Back to main Help index</a>
</span>
d19 179
d200 2
@


1.5
log
@added info to top toc
PR:
Obtained from:
Submitted by:
Reviewed by:
@
text
@d27 2
a28 5
		<dd><a href="DomAdminAuditLogs.html">Using administrative audit logs</a>
	 <dd> <a href="/project/www/docs/ProjectQuotas.html" >Administering project 
      quotas</a> </dd>
    <dd> <a href="/project/www/docs/DomAdminAuditLogs.html" >Using a project database</a> 
    </dd><dt><a href="/servlets/HelpTOC">Back to main Help index</a>
@


1.4
log
@changed heading in doc to include both resources and actions
@
text
@d19 1
a19 1
			<li><a href="#userroles">Editing user role assignments</a>
d28 4
a31 1
	<dt><a href="/servlets/HelpTOC">Back to main Help index</a>
d96 1
a96 1
</dl>
@


1.3
log
@minor edits
@
text
@d22 1
a22 1
			<li><a href="#viewaddresources">Viewing and adding resources</a>
d132 1
a132 1
<a name="viewaddresources"></a><span class="InputHeader">Viewing and adding resources</span>
d134 1
a134 1
Resources are all of the different elements used in this site including tools, content, projects, and web pages. User roles and permissions on this site are defined by the specific resources they apply to. For example, each of these permissions -- "Mailing List - View," "Project - Suggest," "Version Control - Commit" -- is comprised of a certain resource on this site and the action being permitted in that resource. In these three examples, the resources are, respectively: mailing list, project, and version control.
@


1.3.2.1
log
@Ported over Lori's new and changed help documents.
@
text
@d22 1
a22 1
			<li><a href="#viewaddresources">About resources and actions</a>
d132 1
a132 1
<a name="viewaddresources"></a><span class="InputHeader">About resources and actions</span>
d134 1
a134 1
<b><i>Resources</i></b> are all of the different elements used in this site including tools, content, projects, and web pages. User roles and permissions on this site are defined by the specific resources they apply to. For example, each of these permissions -- "Mailing List - View," "Project - Suggest," "Version Control - Commit" -- is comprised of a certain resource on this site and the <b><i>action</i></b> being permitted within that resource. In these three examples, the resources are, respectively: mailing list, project, and version control.
@


1.3.2.1.4.1
log
@updating branch with latest help files
@
text
@d19 1
a19 1
			</a><li><a href="#aboutroles"></a><a href="#userroles">Editing user role assignments</a>
d27 2
a28 2
		<dd><a href="DomAdminAuditLogs.html">Using domain administration tools</a>
    <dt><a href="/servlets/HelpTOC">Back to main Help index</a>
d93 1
a93 1

@


1.3.2.1.4.2
log
@fixed broken links.
Issue number:
Obtained from:
Submitted by:
Reviewed by:
@
text
@d55 1
a55 1
You can also tailor roles and permissions for sets of users by creating user groups, and for sets of projects by making project groups. For more information about this, see <a href="DomAdminProjectGroups.html">Creating and editing project groups</a> and <a href="DomAdminUserGroups.html">Creating and editing user groups</a>.
@


1.3.2.1.4.2.2.1
log
@fixed broken links.
Issue number:
Obtained from:
Submitted by:
Reviewed by:
@
text
@d64 1
a64 1
	<dd>The user's affiliation with any user group or project categories in this domain are listed here. User groups and project groups are created and configured by you as the Domain Administrator. See <a href="DomAdminProjectGroups.html">Creating and editing project groups</a> and <a href="DomAdminUserGroups.html">Creating and editing user groups</a> for more information.
a74 1

d88 1
a88 1
	<dd>Note that when individual users are part of particular project groups or user groups, you can assign attributes and modify multiple user accounts associated with those groups by using the <b>Project Group Edit</b> or <b>User Group Edit</b> screens. See <a href="DomAdminProjectGroups.html">Creating and editing project groups</a> and <a href="DomAdminUserGroups.html">Creating and editing user groups</a> for more information.
@


1.2
log
@added section on viewing and adding resources
@
text
@d1 2
a2 2
<HTML>
<HEAD>
d4 1
a4 1
<TITLE>Administering roles and permissions</TITLE>
d6 31
a36 31
</HEAD>
<BODY>
<SPAN CLASS="Header">Administering roles and permissions</SPAN>
<P>
<SPAN CLASS="PlainText"><B>Help for domain administration: Index</B>
<P>
<UL>
	<DL>
	<DT><A HREF="DomAdminOverview.html">Domain administration overview</A>
		<DD><A HREF="DomAdminAddUsers.html">Adding and editing user accounts</A>
		<DD><B>You are here: Administering roles and permissions
			<UL>
			<LI><A HREF="#aboutroles">Understanding roles and permissions
			<LI><A HREF="#userroles">Editing user role assignments</A>
			<LI><A HREF="#editroles">Editing roles</A>
			<LI><A HREF="#addroles">Adding roles</A>
			<LI><A HREF="#viewaddresources">Viewing and adding resources</A>
			</UL></B>
		<DD><A HREF="DomAdminUserGroups.html">Creating and editing user groups</A>
		<DD><A HREF="DomAdminProjectGroups.html">Creating and editing project groups</A>
		<DD><A HREF="DomAdminProjectApproval.html">Approving, disapproving, or deferring projects</A>
		<DD><A HREF="DomAdminAuditLogs.html">Using administrative audit logs</A>
	<DT><A HREF="/servlets/HelpTOC">Back to main Help index</A>
	</DL>
</UL>
<P>


<HR NOSHADE SIZE=1>
<A NAME="aboutroles"></A><SPAN CLASS="InputHeader">Understanding roles and permissions</SPAN>
<P>
d38 96
a133 94
<UL>
<LI><B><I>Domain roles</I></B> give users access to generalized information and actions throughout the site. Domain Administrators assign and configure domain roles to all users on this site. Every new user automatically gets the "registered user" domain role by virtue of being registered on your domain. It is also possible to create other domain roles; more about this is covered in the <A HREF="#addroles">Adding roles</A> section of this document.
<P>
<LI><B><I>Project roles</I></B> are limited to information and actions within a project. Domain Administrators also can configure project roles, but by design Project Owners usually assign project roles to users when they become project members.
</UL>
<P>
Roles are either assigned to users through membership in a project, or through association with project groups or user groups. All roles have a default set of permissions associated with them. These permissions govern the users' ability to conduct certain actions on this site. As Domain Administrator, you can:
<UL>
<LI>Use and assigning existing roles "as is."
<P>
<LI>Alter existing roles by changing which permissions are associated with them.
<P>
<LI>Create entirely new roles and designate permissions for them. (You cannot, however, create new permissions.) See <A HREF="#addroles">Adding roles</A>.
</UL>
<P>
You can also tailor roles and permissions for sets of users by creating user groups, and for sets of projects by making project groups. For more information about this, see <A HREF="DomAdminCategories.html">Creating and editing project groups</A> and <A HREF="DomainAdminUserGroups.html">Creating and editing user groups</A>.
<P>

<HR NOSHADE SIZE=1>
<A NAME="userroles"></A><SPAN CLASS="InputHeader">Editing user role assignments</SPAN>
<P>
The fields and options in the bottom section of the <B>Edit User</B> page enable you to view and change the individual user's role assignments.
<P>
<DT><B><I>Group Memberships</I></B>
	<DD>The user's affiliation with any user group or project categories in this domain are listed here. User groups and project groups are created and configured by you as the Domain Administrator. See <A HREF="DomAdminCategories.html">Creating and editing project groups</A> and <A HREF="DomainAdminUserGroups.html">Creating and editing user groups</A> for more information.
<P>
<DT><B><I>Domain-wide Roles</I></B>
	<DD>Domain roles assigned or conferred to the user are listed here. These are generalized roles that permit the user to view site pages and conduct site actions not associated with specific projects. See previous  <A HREF="#aboutroles">Understanding roles and permissions</A> section. 
<P>
<DT>
<B><I>Roles in domain's public projects</I></B>
	<DD>Every public project hosted on this domain is automatically part of the default project group labeled (not surprisingly) "All public projects." Any roles the user holds in such projects are flagged here. See <A HREF="DomAdminProjectGroups.html">Creating and editing project groups</A> for more information.
	<P>
<DT><B><I>Submit Changes</I></B>
	<DD>This button submits any modifications to the individual user account made in the fields above. Modifications to the user's roles are separate actions.
	<P>
<DT><B><I>Project Roles</I></B>
	<DD>Roles the user holds that are associated with specific projects are listed here, grouped by project name. Project names link to project home pages. This list includes both open source and private, proprietary projects. See <A HREF="#aboutroles">Understanding roles and permission</A> section for a more comprehensive discussion of roles.
<P>
<DT><B><I>Detailed Role Info</I></B>
	<DD>These links lead to secondary screens with more detailed role information associated with the current user:
	<P>
		<UL>
		<LI><I>Direct and derived roles</I> displays two different sets roles held by the user. <I>Direct roles</I> are those roles expressly assigned to the user. For example, the user requested and was approved for a certain role in a project. <I>Derived roles</I> are roles <I>conferred</I> to this user because she/he is a member of a project specifically associated with a project group's set of roles, or belongs to a user group assigned a unique set of roles.
		<P>
		<LI><I>Details of permissions</I> displays a screen rather unceremoniously entitled <B>Permission Dump</B> because it tabulates literally every single permission the user holds in your domain.
		</UL>
		<P>
	<DD>Note that when individual users are part of particular project groups or user groups, you can assign attributes and modify multiple user accounts associated with those groups by using the <B>Project Group Edit</B> or <B>User Group Edit</B> screens. See <A HREF="DomAdminCategories.html">Creating and editing project groups</A> and <A HREF="DomainAdminUserGroups.html">Creating and editing user groups</A> for more information.
<P>

<DT><B>Other operations: <I>Delete User</I></B>
	<DD>This link removes the current user account. A confirmation message prompts you for verification before this action is completed.
</DL>
<P>


<HR NOSHADE SIZE=1>
<A NAME="editroles"></A><SPAN CLASS="InputHeader">Editing roles</SPAN>
<P>
This site features a set of default roles that you may view using the <I>Administer Roles</I> link in the "Admin Options" of your <B>Start Page</B>. This displays the <B>Role List</B> page with all site roles listed as either domain or project-level. A brief description of each role is included.
<P>
To view a list of individual permissions associated with this role, click on the role name link in the <B>Role List</B> page. Each permission listed on the <B>Editing Role</B> page is characterized by both the site resource and site action that it enables, i.e. "Project - Suggest" or "Version Control - Update." The far right "Resource(s)" column defines in which site resources each permission is effective. The default is for each permission to apply to all available resources.
<P>
As domain administrator, you have the option to modify this site's pre-packaged roles by changing the permissions associated with them as needed. Placing a check mark in the boxes next to a permission <I>removes this permission</I> from the role.
<P>
If you wish to <I>add</I> permissions to a role, click the <I>Add New Permission</I> link at the top of the <B>Editing Role</B> page. This screen gives you a list of all available permissions. To add permissions, place check marks in the appropriate boxes.
<P>
In addition to editing roles by adding and removing permissions, you can modify or limit which resources the permissions associated with that role will apply to. The resource section at the bottom of the <B>Add Permission to Role</B> page lets you determine in which site resources to allocate the role's new permissions.
<P>
<UL>
<LI>Selecting "All available resources .*" applies the selected permissions for this role universally to all site resources available to this role, including both web content and source code.
<P>
<LI>Choosing "All web pages /www/.*" limits the selected permission for this role specifically to web pages. This means the scope of these permissions does not pertain to any source code level access, but only to web page content. For example, assigning the "Version Control - Commit" permission to a role and designating "All web pages /www/.*" as the resource results in users with this role only being able to check out and commit web page content, not project source code.
</UL>
After you have selected the permissions to add and determined the site resources to apply these to, click the <B><I>Add Permissions</I></B> button at the bottom of the page.
<P>
See the section on <A HREF="#viewaddresources">Viewing and adding resources</A> for more information about site resources. 
<P>

<HR NOSHADE SIZE=1>
<A NAME="addroles"></A><SPAN CLASS="InputHeader">Adding roles</SPAN>
<P>
If your site has special requirements that none of the default roles meet, you can also create custom roles and assign the appropriate permissions to them. To do this, in the <B>Role List</B> page click the "Add New Role" link in either the domain or project section, depending upon the type of role you want to create. Depending upon which one you click, this displays either the <B>Add Domain Role</B> or <B>Add Project Role</B> page. You can switch between these pages using the links at the top of this page.
<P>
You must determine what you want the scope of your newly created role to be. If you want to create a role that enables certain user actions universally across the site, add the new role as a domain role. If you want to create a role with permissions that are <I>not</I> universally enabled across this site, you should add the new role as a project role. When project roles are assigned, their associated permissions are granted to the user only within that project.
<P>
The <B>Add Domain Role</B> and <B>Add Project Role</B> pages list every permission/action available at that level. Use this feature with extreme caution! Assigning permissions to roles may have security implications.
<P>


<HR NOSHADE SIZE=1>
<A HREF="viewaddresources"></A><SPAN CLASS="InputHeader">Viewing and adding resources</SPAN>
<P>
d135 1
a135 1
<P>
d137 10
a146 10
<P>
You can view a complete list of all available resources on this site by clicking the <I>Resource List</I> link at the top of the <B>Editing Role</B> page. The default items in the Resource List page are "All available resources (.*)" and "All web pages (/www/.*)".  Clicking on the resource link displays the <B>Edit Resource</B> screen where there is short, identifying description and the pattern that represents the resource as a regular expression.
<P>
As the domain administrator, you can also create new resources and define them using the <I>Add New Resource</I> link at the top of the <B>Editing Role</B> page. This is a powerful and flexible administrative feature. For example, you might decide that you want to create new user roles with permissions that only apply to certain types of files. If these were java files, you could define that as a resource using the regular expression "*.java". Then you could either create new roles or modify existing roles by adding permissions defined with this "*.java" resource. Your newly created resource automatically appears in the <B>Add Permission to Role</B> page. When you grant these roles to users, their permissions are limited to java files only.
<P>

<HR NOSHADE SIZE=1>
<A HREF="DomAdminOverview.html">Back to help for domain administration</A><BR>
<A HREF="/servlets/HelpTOC">Back to main Help index</A>
</SPAN>
d148 2
a149 2
</BODY>
</HTML>@


1.1
log
@initial revision for 1.0 release
@
text
@d20 2
a21 1
			<LI><A HREF="#editroles">Editing and creating roles</A>
d100 1
a100 1
To view a list of individual permissions associated with this role, click on the role name link in the <B>Role List</B> page. Each permission listed on the <B>Role Edit</B> page is characterized by both the site resource and site action that it enables, i.e. "Project - Suggest" or "Version Control - Update."
d102 1
a102 1
As domain administrator, you have the option to modify these default roles by changing the permissions associated with them as needed. Placing a check mark in the boxes next to a permission <I>removes this permission</I> from the role. 
d104 1
a104 1
If you wish to <I>add</I> permissions to a role, click the <I>Add New Permissions</I> link at the top of the <B>Role Edit</B> page. This screen gives you a list of all available permissions. To add permissions, place check marks in the approporate boxes.
d106 1
a106 1
The resource section at the bottom of the <B>Role Edit</B> page lets you determine in which site resources to allocate the role's new permissions.
d113 1
a113 1
See the <A HREF="#viewaddresources">Viewing and adding resources</A> section for more information about site resources. 
d115 1
a115 1
After you have selected permission to add and determined the site resources to apply these to, click the <B><I>Add Permissions</I></B> button at the bottom of the page.
d132 7
a138 5





@

