<?xml version='1.0' encoding='utf-8' ?>
<!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN" "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
<!ENTITY % BOOK_ENTITIES SYSTEM "../../Reference_Guide.ent">
%BOOK_ENTITIES;
]>
<section id="sect-Reference_Guide-Portal_Default_Permission_Configuration">
	<title>Portal Default Permission Configuration</title>
		<para xml:id="sect-Reference_Guide-Portal_Default_Permission_Configuration-Overview">
			The default permission configuration for the portal is defined through <emphasis>org.exoplatform.portal.config.UserACL</emphasis>
         component configuration in the file <filename>portal.war:/WEB-INF/conf/portal/portal-configuration.xml</filename>.
		</para>
		<para>
			It defines 8 permissions types:
		</para>
		<variablelist>
			<varlistentry>
				<term>super.user</term>
				<listitem>
					<para>
						The super-user as <emphasis>root</emphasis> has all the rights on the eXo Platform.
					</para>
				</listitem>
			</varlistentry>
			<varlistentry>
				<term>portal.administrator.groups</term>
				<listitem>
					<para>
						Any member of those groups are considered administrators. The default value is <emphasis>/platform/administrators</emphasis>.
					</para>
				</listitem>
			</varlistentry>
			<varlistentry>
				<term>portal.administrator.mstype</term>
				<listitem>
					<para>
						Any user with that membership type would be considered administrator or the associated group with the <emphasis>manager</emphasis> by default.
					</para>
				</listitem>
			</varlistentry>
			<varlistentry>
				<term>portal.creator.groups</term>
				<listitem>
					<para>
						This list defines all groups that will be able to manage the different portals. Members of this group
                  also have the permission to create new portals. The format is <emphasis>membership:/group/subgroup</emphasis>.
					</para>
				</listitem>
			</varlistentry>
			<varlistentry>
				<term>navigation.creator.membership.type</term>
				<listitem>
					<para>
						Defines the membership type of group managers. The group managers have the permission to create and edit group pages and they can modify the group navigation.
					</para>
				</listitem>
			</varlistentry>
			<varlistentry>
				<term>guests.group</term>
				<listitem>
					<para>
						Any anonymous user automatically becomes a member of this group when they enter the public pages.
					</para>
				</listitem>
			</varlistentry>
			<varlistentry>
				<term>mandatory.groups</term>
				<listitem>
					<para>
						Groups that cannot be deleted.
					</para>
				</listitem>
			</varlistentry>
			<varlistentry>
				<term>mandatory.mstypes</term>
				<listitem>
					<para>
						Membership types that cannot be deleted.
					</para>
				</listitem>
			</varlistentry>
		</variablelist>

<programlisting language="xml">&#60;component&#62;
  &#60;key&#62;org.exoplatform.portal.config.UserACL&#60;/key&#62;
  &#60;type&#62;org.exoplatform.portal.config.UserACL&#60;/type&#62;
  &#60;init-params&#62;
    &#60;value-param&#62;
      &#60;name&#62;super.user&#60;/name&#62;
      &#60;description&#62;administrator&#60;/description&#62;
      &#60;value&#62;root&#60;/value&#62;
    &#60;/value-param&#62;

    &#60;value-param&#62;
      &#60;name&#62;portal.creator.groups&#60;/name&#62;
      &#60;description&#62;groups with membership type have permission to manage portal&#60;/description&#62;
      &#60;value&#62;*:/platform/administrators,*:/organization/management/executive-board&#60;/value&#62;
    &#60;/value-param&#62;

    &#60;value-param&#62;
      &#60;name&#62;navigation.creator.membership.type&#60;/name&#62;
      &#60;description&#62;specific membership type have full permission with group navigation&#60;/description&#62;
      &#60;value&#62;manager&#60;/value&#62;
    &#60;/value-param&#62;
    &#60;value-param&#62;
      &#60;name&#62;guests.group&#60;/name&#62;
      &#60;description&#62;guests group&#60;/description&#62;
      &#60;value&#62;/platform/guests&#60;/value&#62;
    &#60;/value-param&#62;
    &#60;value-param&#62;
      &#60;name&#62;access.control.workspace&#60;/name&#62;
      &#60;description&#62;groups with memberships that have the right to access the User Control Workspace&#60;/description&#62;
      &#60;value&#62;*:/platform/administrators,*:/organization/management/executive-board&#60;/value&#62;
    &#60;/value-param&#62;
  &#60;/init-params&#62;
&#60;/component&#62;
</programlisting>
	  <para xml:id="sect-Reference_Guide-Portal_Default_Permission_Configuration-Overwrite_Portal_Default_Permissions">
	<citetitle>
		<emphasis role="bold">Overwrite Portal Default Permissions</emphasis>
	</citetitle>
    </para>
      <para>When creating the custom portals and portal extensions, it is possible to override the default configuration by
      using <emphasis>org.exoplatform.portal.config.PortalACLPlugin</emphasis>, configuring it as an external-plugin of
      <emphasis>org.exoplatform.portal.config.UserACL</emphasis> service:</para>

<programlisting language="xml">&#60;external-component-plugins&#62;
    &#60;target-component&#62;org.exoplatform.portal.config.UserACL&#60;/target-component&#62;
    &#60;component-plugin&#62;
      &#60;name&#62;addPortalACLPlugin&#60;/name&#62;
      &#60;set-method&#62;addPortalACLPlugin&#60;/set-method&#62;
      &#60;type&#62;org.exoplatform.portal.config.PortalACLPlugin&#60;/type&#62;
      &#60;description&#62;setting some permission for portal&#60;/description&#62;
      &#60;init-params&#62;
        &#60;values-param&#62;
          &#60;name&#62;access.control.workspace.roles&#60;/name&#62;
          &#60;value&#62;*:/platform/administrators&#60;/value&#62;
          &#60;value&#62;*:/organization/management/executive-board&#60;/value&#62;
        &#60;/values-param&#62;
        &#60;values-param&#62;
          &#60;name&#62;portal.creation.roles&#60;/name&#62;
          &#60;value&#62;*:/platform/administrators&#60;/value&#62;
          &#60;value&#62;*:/organization/management/executive-board&#60;/value&#62;
        &#60;/values-param&#62;
      &#60;/init-params&#62;
    &#60;/component-plugin&#62;
  &#60;/external-component-plugins&#62;
</programlisting>

 <para>
	<prompt>
		<emphasis role="bold">See also</emphasis>
	</prompt>
</para>
		<itemizedlist>
           <listitem>
               <para><link linkend="sect-Reference_Guide-Default_Portal_Configuration">Default Portal Configuration</link></para>
           </listitem>
           <listitem>
               <para><link linkend="sect-Reference_Guide-Portal_Navigation_Configuration">Portal Navigation Configuration</link></para>
           </listitem>
		    <listitem>
               <para><link linkend="sect-Reference_Guide-Internationalization_Configuration">Internationalization Configuration</link></para>
           </listitem>
		   <listitem>
               <para><link linkend="sect-Reference_Guide-Javascript_Configuration">JavaScript Configuration</link></para>
           </listitem>
       </itemizedlist>
</section>