Users

The term superuser may refer either to a system user (an account type) or to a role (a definition of what a user is allowed to do in the system). In a vanilla installation of Magnolia, the superuser role is assigned to the superuser account. In addition to the superuser role, the superuser account has some other roles too, see Default roles, groups and users.

As the name implies, the permissions of the superuser account are usually unrestricted in any way. For instance, superuser can read and write to all default JCR workspaces on /.

On a production system, create specific users with distinct roles and deactivate the superuser account.

The term anonymous may refer either to a system user or to a role. The latter is assigned to the former. Apart from the anonymous role, the anonymous system user is by default assigned other roles too, see Default roles, groups and users.

Every Magnolia resource intended to be accessible without authentication must be enabled for the anonymous system user. A users that interacts with Magnolia without authentication is determined as anonymous user.

A logged-in user can set one’s own preferences by clicking the Edit user profile action in the top right corner. To access the action, click the down arrow in the corner:

The action opens a dialog whose User profile tab allows changing the user’s password, full name and email address:

Use the dialog’s Preferences tab to edit the user’s language and the time zone.

Every user can set one’s own preferred time zone. Open the user preferences dialog, click the Preferences tab and set the time zone accordingly.

Magnolia continues to record events such as page creation using the host server time. The recorded time is converted and displayed in the user’s preferred time zone.

In Magnolia, users are organized as follows:

Permissions are defined in the ACL. Users inherit permissions from the roles and groups assigned to them.

In a small site you can manage users and groups in Magnolia. On a larger site (hundreds of users), it is better to manage users and groups in an enterprise-grade user management infrastructure such as Microsoft Active Directory. You would define roles and ACLs in Magnolia but manage users and groups in the external system.

Every user known to Magnolia is granted a set of permissions defined by roles. You can either assign roles directly to a user, or assign a user to a group that itself grants a set of roles (see organizing users above).

Use the Security app to edit the permissions. The app is available in the Set up group of the AdminCentral and by default the superuser role is required to access it.

The Security app provides subapps to edit the users (system users and public users), groups and roles. Select the user you want to edit and double-click it or use the Edit user action. The Edit user action is available in the following subapps: Users, System users and Public users.

The dialog where you can edit user details has three tabs:

Automatic lockout is a security precaution that prevents users from accessing Magnolia after a number of failed login attempts.

By default, the lockout is triggered, and the account is automatically disabled by a minimum of N+1 failed login attempts. The number of failed attempts is configurable. When a non-existent username is entered lockout does not occur as the account does not exist. The lockout applies to system users and admin users but does not affect public users. After lockout, an administrator can re-enable the user account by checking the Enabled box in the user profile. When a lockout occurs, this checkbox is cleared.

The number of failed login attempts N that will trigger lockout is configurable using the property maxFailedLoginAttempts at Configuration > /server/security/userManagers/system and /admin. Different values may be set for Users and Systems Users.

The LDAP Connector module is a standard JAAS login module that connects to any LDAP V3 supported directory service. This module is useful where an enterprise-grade user management infrastructure already exists. With the JAAS standard support you can meet single sign-on requirements or connect to legacy LDAP/ADS directory servers.