Permissions and "Regular Members"?

[jstelly]

I think I generally have the way permissions work in SMF figured out, but something seems to be odd so maybe I just need someone to give me a brief explanation...

I'm running SMF 1.1 after a migration from phpbb.  I don't see a "registered users" or "authenticated users" option in the security settings.  The "Regular Members" special group almost works, but it breaks down for what I want as soon as I start assigning users to groups (because that removes them from the "Regular Members" special group):

Say I have a 'General' board that I want all registered users to be able to view and post in, but then I have two special boards called 'V.I.P. A' and 'V.I.P. B'.  I should be able to create a membergroup and give it rights to VIP-A and another membergroup and give it rights to VIP-B and add users to each group to give them access.

But with the current scheme, I also have to specify that membergroups VIP-A and VIP-B get access to 'General' because any user who I add to those groups now has a primary membergroup and no longer qualifies as a "Regular Member".

In this simple scenario it's not a big deal, but it quickly becomes a management headache when you have to maintain permissions for several boards all with their own slight variations of who can do what... and now I have to change 3 sets of permissions (Regular Members, VIP-A and VIP-B) if I want to change what normal users can do on the general board (because I still consider people who are members of the VIP-A and VIP-B membergroups as normal users when talking about my General board).

So what I think I want is a "registered users" group that doesn't have people removed from it if they happen to be in a group.  Does that make sense or am I missing an aspect of the product that makes this a non-issue?

[KGIII]

I think this is what you are looking for.

Open Administration Center
Scroll down and click on Permissions
Click on the Settings tab
Tick the box "Enable advanced by-board permissions"
Press the Save button

You should then be able to assign specific membergroups permissions for specific boards so that if everyone has permission for, say, the General board people in the VIP group will also have permissions to access it as well as have permissions to access the general board still.  

[jstelly]

I've got that enabled.  Here's my problem boiled down:

"Regular Members" is as close to an "All Users" group as SMF has.  By default, users have no membergroup so they're regular members.  When I add someone to a VIP group, it seems they get removed from the "Regular Members" group and that removal is the problem.

Shouldn't permissions be additive, as in if a user in my above scenario was in both group VIP-A and VIP-B, they should have access to both boards.  So what's the point of removing users from the "Regular Members" group?

Thanks for the answer, but hopefully my reply here better explains the problem I'm having.

[KGIII]

I couldn't think of the best way to describe it so I made a picture.

http://kgiii.info/ignore/permissions.jpg

[Smurfbutcher Bob]

JS, are you referring to the user account itself?

When I add someone to a VIP group, it seems they get removed from the "Regular Members" group and that removal is the problem.

SMF behaves almost exactly as you desire. It isn't inheritance, but more of a cascade - but it is still adequate when all is said and done.

The SMF "Primary Group" is what I suspect you've been setting.  Generally, you'll leave that as "regular".  It dictates the group membership that is displayed next to the user's posts (look to the left, you'll see "Support Team Apprentice" for KGIII, and nothing for you or I).

Additional groups are found in an expandable section, under that primary group box. Click it, and you'll reveal a pile of checkboxes with all groups listed. You can then add additional groups, etc, as desired.

Is that what you're looking for?

[jstelly]

The SMF "Primary Group" is what I suspect you've been setting.  Generally, you'll leave that as "regular".  It dictates the group membership that is displayed next to the user's posts (look to the left, you'll see "Support Team Apprentice" for KGIII, and nothing for you or I).

Yes, I see in the database in the members table there's an ID_GROUP column (which looks like the primary membergroup) and an additionalGroups column.  The problem I have is, if someone has a 0 in the ID_GROUP column, going to a membergroup screen and adding the member to that group sets their ID_GROUP column instead of just adding the group to their additionalGroup column.

How should I be adding members to groups so that it doesn't set the group as their primary, thereby removing them from the 'regular members' group?

And thanks, I think you understand what I'm trying to do, the problem is, I don't see how to do it.

[SleePy]

Grab their current additional groups and then save it with the added on value.

I think $user_info already has it somewhere so you just need to clean it up and save it in the database like this: 1, 5, 8, 19

[jstelly]

I've made some code changes to SMF to make it behave how I'd like it to.  Most of the code was already there, it just required a few minor changes.

I've also requested this as a feature request for a future release, that thread is here.

Thanks for all the help on this, guys.

[codenaught]

jstelly, I never thought of this before, but I agree with you that you may not necessarily want a member to completely leave the primary group they were currently a part of before the change was made.

But just so you are aware, you can configure primary and additional groups in a member's profile under Account Related Settings so at least that way a member can be a part of more than one group and you wouldn't have to worry about them losing access to other groups.

I see the feature in Admin / Membergroups more useful for bulk management, when you need to add a bunch of users to a membergroup at once. For individual group assignment, going to the member's profile is the preferred way to do it.

Edit: I see, this only applies to the Regular Members group because Regular Members can't be an additional group.