The EuroCMS Accounts Module

The Accounts module manages all the accounts of an ECMS installation. EuroCMS applies the following control lists: RBAC, LBAC.

Domain-Role-Based Access Control List. DRBAC. Dr. Bac if you want to be cute about it.

• Users

• Groups

• API Users

• Roles

• Permissions

Chain of Commands

A user in a lower chain of command cannot view and or delete anything of a user that is higher in the Chain Of Command.

No matter if the users has the, for example users_history permission, they cannot view the history of a user higher in command.

ACL FLOW

This is the step by step ACL FLOW:

• Login

Credentials check

• Roles

Getting the list of components the users has rights too.

This will be displayed in the admin navigation menu.

• Permissions

When clicked on, for example, the link for the Users module, we will check for the specific permissions this logged in users has: (users_add,users_delete).

Users

The EuroCMS users.

There can only be one Owner user. This user is the owner of the entire EuroCMS installation. The admins are the next in command in terms of power. Although they can be admin of a website and or websites, they don't have these power by default. The owner users has no restrictions. It's advised, even if you have only one domain, to create an admin account with all needed permissions to work, and never use the Owner user.

Handle the IP blocking via the content module? IP blocking the /login page?

Contemplate if it's still useful to enable IP blocking per users if the /login page is already blocked via content.

Let's paint a scenario. A user is out of office/on holiday/at a meeting in a restaurant, they need him ASAP, to fix things. The /login page is IP blocked with the Office IP.

So, you connect to the Office VPN, and connect to the /login page. No need for the office.

You can implemented a wide variety of security for this, it's just how secure you want it. The current security implementation makes it highly secure.

After user feedback, with the v1, we will see if the demand for further security implementation is wanted.

To he honest, I'll probably want to implement all of the security implementations you can think of. To make it a highly interesting products for companies/governments/..., with high security demands.

Groups

The EuroCMS groups.

Roles

A role can have preset R/W settings for a specific ECMS components.

Permissions

The permissions/features are the features that the module has made available.

SELECT * FROM permissions WHERE component_name = 'users' AND permission_id in (1,2,3,5,6);

Users module permissions list

Access Control List

Think about using a PHP constant for this?

$acl_base = array(
	"components" => array()
);

// user logged in,
// Get the users permission...

$acl_add = array(
    "components" => array(
      "modules" => array(
        "Users" => array("users_add","users_delete"),
        "Files" => array()
      ),
      "themes" => array("W3schools"),
    )
);



$acl = array_merge($acl_base, $acl_add);

print_r($acl);

output of the above code:

Array
(
    [components] => Array
        (
            [modules] => Array
                (
                    [Users] => Array
                        (
                            [0] => users_add
                            [1] => users_delete
                        )

                    [Files] => Array
                        (
                        )

                )

            [themes] => Array
                (
                    [0] => W3schools
                )

        )

)

Reference

• https://en.wikipedia.org/wiki/Role-based_access_control

• https://www.developer.com/open-source/creating-a-custom-acl-in-php/

• https://stackoverflow.com/a/4415733

• https://www.codementor.io/@geggleto/php-psr-7-acl-package-d0g72j59c

• https://www.openproject.org/docs/system-admin-guide/users-permissions/

•