4.17. Users, Groups, and Roles

When you manage permissions in the CMS, you assign users to a role. Each role has a particular set of privileges needed to create, maintain, publish, and view content. You create groups programmatically or through the WAF, Portal, or Administrator user interfaces (outside the CMS), which lets you further organize users. You can assign users, groups, and roles to specific workflows, thus streamlining the process for creating content.

While there is no required order for entering information into the CMS, you must create users and roles before you assign them to workflows. You should add your roles and users (and groups, if you will be using them) before making any other modifications to the CMS.

Because the CMS can be divided into multiple sections, and each section is treated independently, you need to create any new roles, modify existing roles, and apply permissions to roles in all sections. You do not have to assign the same users to roles in all sections (unless their job description includes roles in all sections). For more information on permissions and privileges, refer to Section 4.12 Permissions and Privileges.

While roles are configurable, common roles within the CMS are:

Alert Recipient

Receives Workflow Alerts, Overdue Workflow Task Alerts, and Content Expiration Alerts by email. This role has no privileges. The CMS automatically creates the Alert Recipient role when a new content section is created.

You can customize the emails that are sent. Refer to the CMS Deployment Guide.

The Content Expiration Alert is dependent on the selections chosen when publishing the content item. The CMS sends content expiration alert emails to members of the Alert Recipient role in each content section. These emails are triggered by the expiry date of the lifecycle, which is set when the content item is published.

Workflow and Overdue Workflow Task alerts are dependent on the configuration of the workflow notification and mail services. These services must be properly installed and configured prior to activating alerts.

Each content section defines which alerts it sends on a state change for each of the three task types (Author, Edit, and Deploy). The CMS sends Workflow Alerts when a task starts, ends, is disabled, or is rolled back. It sends Overdue Workflow Task Alerts when a task exceeds the amount of time it was assigned. Refer to Section 4.18 Workflows.

The emails that are sent describe the state that has either been completed or started, the name of the content item the task was performed on, the name of the person who triggered the task completion or start, the latest comment on the workflow task, and a link back to a page on the CMS where recipients can begin their own task.

Each content section contains parameters that let you specify how long a task can remain incomplete before it is considered overdue. When a task is overdue, the system can send alerts to participants, reminding them that they have to finish their task.

Author

Creates new content items. The privileges for this role include creating, editing, and previewing items.

Editor

Verifies new content items. The privileges for this role include editing and previewing items.

Manager

Oversees the overall content or forms section. The privileges for this role include administering roles, workflows, lifecycles, categories, and content types.

Publisher

Approves and deploys content to the website. The privileges for this role includes previewing, publishing, and categorizing items.

Trusted User

Can choose their own workflow. Content section only.

Content Reader

Users able to read private sections of the public website. (Public sites are available, by definition, to anyone.) Content readers are also called "Viewers."

If you have any questions about roles at your company installation, ask your System Administrator.

For each role, you can assign members (users or groups) and administrators by searching the CMS user database. Role administrators can make modifications to any role member, as compared to the Manager role, who can make modifications to any role (including the role administrator).

While there is no required order for initially entering information into the CMS, you must assign users to roles before you can assign a role to a task in a workflow, or you will not be able to create content items.