As with all applications, you need to have certain rights in order to be able to do something within an application. The same thing goes for the Content Hub. Without user accounts properly configured, things will not work as expected.
So, how does it work for the Content Hub?
As you might know, the Content Hub exists of different modules, like DAM, PCM, CMP, etc. In order for a user to access certain modules, they need to have access to that specific module, next to that they need to have at least read access to the page and its entity definition. For this blog post, we will stick to the DAM module, but it basically works the same for other modules, pages and entity definitions.
Let's start off with creating a new user group called C.DAM.Reader. In order to easily spot custom work in the Content Hub, we use the C. as a prefix. The C stands for Client / Custom. Next to that, we include the module for which we are configuring the user group. Last but not least will be the name of the group. Please think about the name, in order to make it descriptive, so others will know what to expect.
For the Name, we fill in C.DAM.Reader, for the modules we select Media. By adding Media to the modules, the person will get rights to the following pages: Assets and Collections. The other pages need to be added manually.
Save the new User group and open up the options. As mentioned earlier, we need to give access to the pages and entity definitions. With the help of the Media module, we get access to the two pages, but not the assets. So let's start by giving access to the approved assets on the Assets page.
Click on the New rule button, and select M.Asset and M.File. We need to include also the M.File, since the M.Asset and M.File are linked to each other. In order to see assets, we need to enable the Read permission. Now would be a good time to check if we can see the Assets on the page. For this, we use a dummy account in the Content Hub. This allows for easy testing. Important: for every module that you add to the user group, this will also be copied over to the user account, but this only happens at the moment the user account has been assigned to a user group. By changing the modules later on a user group, they will NOT be copied over to the connected user accounts.
When we check with our dummy account, you can see that we now have access to the assets on the Assets overview page. You might now think that we're finished with settings this up. But nothing is further from the truth. We have given Read access to all the assets in the Content Hub. We sure don't want to do that. In order for us to change this, we need to restrict access. Go back to the User group policies page. Hit the Add condition button to create a new restriction. Add the following conditions:
- M.Final.LifeCycle.Status: Approved
- M.Content.Repository: Standard
It needs to look like this. Tip: don't put the M.Final.LifeCycle.Status and M.Content.Repository in the same condition. This will then be considered as an OR and not an AND. Thus it will work differently.
With this configured, it will limit access to approved DAM assets only. You will not see this fast via the interface, but with the underlying API, it will surely matter. Tip: always make sure to add these kinds of conditions. This will ensure limited access.
If we test with our account, you will still see the same assets. If we now click on an asset, we will be given a 404 not found error. This is because the account doesn't have access to the Asset Details page. So let us add some access to the Asset detail page. Click on the New rule button add the top and search for Portal page. Check Portal page (Portal.Page) and hit OK. Then check the Read box. When hitting Save, we now have access to all the pages below the Portal page. To limit access of the user group, we need to filter out the specific pages.
Add the following conditions:
- Portal.Page: Asset details
- Portal.Page: Asset details (Video)
- Portal.Page: Similar assets
- Portal.Page: Assets
Save the changes and refresh the page, this is to verify that the test account can still access the pages you want. Tip: If the changes don't seem to reflect on your test account, clear the Content Hub cache to resolve the issue. If that didn't help, you probably have a misconfiguration.
It should look similar to the screenshot below.
This is the first of the Content Hub User groups Series, hope to see you next time!
