The Permissions screen of Portail ZAPP (menu Administration › Users & access › Permissions) decides who can open each screen and perform each action. It is reserved for Administrators.
How access is decided
Each screen or action matches a permission, identified by three names: Module, Controller and Action (for example the Service Desk module, the tickets screen, the "create" action). A permission states:
- the Allowed groups: the codes of the groups whose members have the right;
- Allow anonymous access: the page can be reached without signing in (reserved for a few public pages).
When someone opens a screen or runs an action:
- if no permission exists for that action, access is denied to everyone (deny by default);
- if Allow anonymous access is ticked, access is open to all;
- if the list of allowed groups is empty, access is open to all authenticated users;
- otherwise, access is granted only if the person belongs to one of the allowed groups.
Administrators are not exempt from this rule: they have access because the Administrators group is listed in the shipped permissions. Removing that group from a permission takes the access away from them.
The menu follows its own display rules per group: a visible menu entry does not guarantee access to the screen, and vice versa.
Every change to a permission (creation, group change, deletion, import, copying a group's permissions) is written to the Audit log, with its author and the state before and after. An access denied by a permission is recorded there too, once per screen and per person every five minutes.
The permission list
For each permission the list shows the Module, Controller, Action, Allowed groups (All when the list is empty) and the Anonymous column. Filter by module.
- Edit changes the allowed groups (comma-separated codes; empty = all authenticated users), the Allow anonymous access box and the description.
- + New permission creates a rule for a given module, controller and action.
- Delete removes the rule: the action concerned becomes unreachable for everyone.
Copying a group's permissions
Copy group permissions gives one or more Target groups the same access as a Source group: for every permission where the source group is allowed, the target groups are added. It is an additive merge: no group already allowed is removed. Useful to create a new role from an existing one.
Exporting and importing
- Export downloads the permissions as JSON (those of the filtered module, or all of them).
- Import loads a JSON file in the same format. Missing permissions are added; existing ones are skipped unless Overwrite existing permissions is ticked. The result gives the number of permissions added, updated and skipped.
Use export and import to carry settings from one instance to another (for example from testing to production).
After a Portail ZAPP update
The permission file shipped with Portail ZAPP is only applied at installation. After an update, a new feature therefore usually has no permission on your instance: since everything is denied by default, it answers “access denied” to everyone, except in the rare cases where the new version sets its own permissions at startup.
To make these features usable:
- get the permission file supplied with the version;
- open Import, choose that file and leave Overwrite existing permissions unticked: only missing permissions are added, the ones you have set do not change;
- check in the grid which groups are allowed for the new features.
You can also create a permission by hand with New permission.
See also
- "Managing groups": create the groups to give rights to.
- "Managing user accounts": put a person in their groups.