<?xml version='1.0' encoding='utf-8' ?>
<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN" "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
<!ENTITY % BOOK_ENTITIES SYSTEM "../../Reference_Guide.ent">
%BOOK_ENTITIES;
]>
<section id="sect-Reference_Guide-Portal_Default_Permission_Configuration">
	<title>Portal Default Permission Configuration</title>
	<section id="sect-Reference_Guide-Portal_Default_Permission_Configuration-Overview">
		<title>Overview</title>
		<para>
			The default permission configuration for the portal is defined through <emphasis>org.exoplatform.portal.config.UserACL</emphasis>
         component configuration in the file <emphasis>02portal.war:/WEB-INF/conf/portal/portal-configuration.xml</emphasis>.
		</para>
		<para>
			It defines 8 permissions types:
		</para>
		<variablelist>
			<varlistentry>
				<term>super.user</term>
				<listitem>
					<para>
						The super-user as <emphasis>root</emphasis> has all the rights on the eXo Platform.
					</para>
				</listitem>
			</varlistentry>
			<varlistentry>
				<term>portal.administrator.groups</term>
				<listitem>
					<para>
						Any member of those groups are considered administrators. The default value is <emphasis>/platform/administrators</emphasis>.
					</para>
				</listitem>
			</varlistentry>
			<varlistentry>
				<term>portal.administrator.mstype</term>
				<listitem>
					<para>
						Any user with that membership type would be considered administrator or the associated group with the <emphasis>manager</emphasis> by default.
					</para>
				</listitem>
			</varlistentry>
			<varlistentry>
				<term>portal.creator.groups</term>
				<listitem>
					<para>
						This list defines all groups that will be able to manage the different portals. Members of this group
                  also have the permission to create new portals. The format is <emphasis>membership:/group/subgroup</emphasis>.
					</para>
				</listitem>
			</varlistentry>
			<varlistentry>
				<term>navigation.creator.membership.type</term>
				<listitem>
					<para>
						Defines the membership type of group managers. The group managers have the permission to create and edit group pages and they can modify the group navigation.
					</para>
				</listitem>
			</varlistentry>
			<varlistentry>
				<term>guests.group</term>
				<listitem>
					<para>
						Any anonymous user automatically becomes a member of this group when they enter the public pages.
					</para>
				</listitem>
			</varlistentry>
			<varlistentry>
				<term>mandatory.groups</term>
				<listitem>
					<para>
						Groups that cannot be deleted.
					</para>
				</listitem>
			</varlistentry>
			<varlistentry>
				<term>mandatory.mstypes</term>
				<listitem>
					<para>
						Membership types that cannot be deleted.
					</para>
				</listitem>
			</varlistentry>
		</variablelist>
		
<programlisting language="xml">&#60;component&#62;
  &#60;key&#62;org.exoplatform.portal.config.UserACL&#60;/key&#62;
  &#60;type&#62;org.exoplatform.portal.config.UserACL&#60;/type&#62;   
  &#60;init-params&#62;      
    &#60;value-param&#62;
      &#60;name&#62;super.user&#60;/name&#62;
      &#60;description&#62;administrator&#60;/description&#62;
      &#60;value&#62;root&#60;/value&#62;     
    &#60;/value-param&#62;
      
    &#60;value-param&#62;
      &#60;name&#62;portal.creator.groups&#60;/name&#62;
      &#60;description&#62;groups with membership type have permission to manage portal&#60;/description&#62;
      &#60;value&#62;*:/platform/administrators,*:/organization/management/executive-board&#60;/value&#62;     
    &#60;/value-param&#62;
      
    &#60;value-param&#62;
      &#60;name&#62;navigation.creator.membership.type&#60;/name&#62;
      &#60;description&#62;specific membership type have full permission with group navigation&#60;/description&#62;
      &#60;value&#62;manager&#60;/value&#62;     
    &#60;/value-param&#62;
    &#60;value-param&#62;
      &#60;name&#62;guests.group&#60;/name&#62;
      &#60;description&#62;guests group&#60;/description&#62;
      &#60;value&#62;/platform/guests&#60;/value&#62;     
    &#60;/value-param&#62;     
    &#60;value-param&#62;
      &#60;name&#62;access.control.workspace&#60;/name&#62;
      &#60;description&#62;groups with memberships that have the right to access the User Control Workspace&#60;/description&#62;
      &#60;value&#62;*:/platform/administrators,*:/organization/management/executive-board&#60;/value&#62;     
    &#60;/value-param&#62;           
  &#60;/init-params&#62;   
&#60;/component&#62;
</programlisting>
	</section>
	
	<section id="sect-Reference_Guide-Portal_Default_Permission_Configuration-Overwrite_Portal_Default_Permissions">
		<title>Overwrite Portal Default Permissions</title>

      <para>When creating the custom portals and portal extensions, it is possible to override the default configuration by
      using <emphasis>org.exoplatform.portal.config.PortalACLPlugin</emphasis>, configuring it as an external-plugin of
      <emphasis>org.exoplatform.portal.config.UserACL</emphasis> service:</para>

<programlisting language="xml">&#60;external-component-plugins&#62;
    &#60;target-component&#62;org.exoplatform.portal.config.UserACL&#60;/target-component&#62;
    &#60;component-plugin&#62;
      &#60;name&#62;addPortalACLPlugin&#60;/name&#62;
      &#60;set-method&#62;addPortalACLPlugin&#60;/set-method&#62;
      &#60;type&#62;org.exoplatform.portal.config.PortalACLPlugin&#60;/type&#62;
      &#60;description&#62;setting some permission for portal&#60;/description&#62;
      &#60;init-params&#62;     
        &#60;values-param&#62;
          &#60;name&#62;access.control.workspace.roles&#60;/name&#62;
          &#60;value&#62;*:/platform/administrators&#60;/value&#62;
          &#60;value&#62;*:/organization/management/executive-board&#60;/value&#62;       
        &#60;/values-param&#62;
        &#60;values-param&#62;
          &#60;name&#62;portal.creation.roles&#60;/name&#62;
          &#60;value&#62;*:/platform/administrators&#60;/value&#62;
          &#60;value&#62;*:/organization/management/executive-board&#60;/value&#62;      
        &#60;/values-param&#62;
      &#60;/init-params&#62;
    &#60;/component-plugin&#62;
  &#60;/external-component-plugins&#62;
</programlisting>
	</section>

</section>


