Users

A user is an account that identifies the person accessing Magnolia. In addition to a username, Magnolia stores the user's full name, password, language preference and email address by default. Users inherit their permissions from the groups and roles the are attached to. You can edit users in the Security app.

Types of users

	Type	Example
	Users	People who work on site content such as authors, editors and publishers.
	System users	Administrative accounts with permissions to configure Magnolia, install new modules and create new templates, for example.
	Public users	End users or visitors of the site. They can be registered through the Public User Registration (PUR) module. Registering visitors allows you to provide them with personalized content such as members-only sections of the site, newsletters and mailing lists.

Setting user preferences

Edit user preferences in the Security app.

A logged-in user can edit set their own preferences by clicking the Edit user profile action in the top right corner.

Organizing users

In Magnolia, users are organized as follows:

Users can have both roles and groups.
Groups can have groups and roles.
Roles can have only ACLs.

Permissions are defined in the ACL. Users inherit permissions from the roles and groups assigned to them.

In a small site you can manage users and groups in Magnolia. On a larger site (hundreds of users), it is better to manage users and groups in an enterprise-grade user management infrastructure such as Microsoft Active Directory. You would define roles and ACLs in Magnolia but manage users and groups in the external system.

Get a list of all permissions assigned to a user or group using the Permissions app.

Automatic lockout

Automatic lockout is a security precaution that prevents users from accessing Magnolia after a number of failed login attempts.

By default, the lockout is triggered by a minimum of five failed attempts and the account is automatically disabled. The number of failed attempts is configurable. When a non-existent username is entered lockout does not occur as the account does not exist. The lockout applies to system users and admin users but does not affect public users. After lockout, an administrator can re-enable the user account by checking the Enabled box in the user profile. When a lockout occurs, this checkbox is cleared.

The number of failed login attempts that will trigger lockout is configurable at Configuration > /server/security/userManagers/system and /admin. Different values can be set for Users and Systems Users.

Node name	Value
server
security
userManagers
system
class	info.magnolia.cms.security.SystemUserManager
lockTimePeriod	0
maxFailedLoginAttempts	5
realmName	system
admin
class	info.magnolia.cms.security.MgnlUserManager
lockTimePeriod	0
maxFailedLoginAttempts	5
realmName	admin

Properties:

`allowCrossRealmDuplicateNames`	optional, default is `false` Allows duplicate usernames in different realms. Only applicable to `admin` realm.
`class`	required A class that implements the UserManager interface. Implementations: `info.magnolia.cms.security.MgnlUserManager` manages users stored in Magnolia. `info.magnolia.cms.security.ExternalUserManager` manages JAAS users. `info.magnolia.cms.security.HierarchicalUserManager` is a variation of `MgnlUserManager` that stores users hierarchically using the structure `/<path>/<first letter of username>/<first two letters of username>` such as `/public/j/js/jsmith`. `info.magnolia.cms.security.DelegatingUserManager`retrieves the user's ACLs. `info.magnolia.cms.security.SystemUserManager` manages system users such as `anonymous` and `superuser`.
`lockTimePeriod`	optional, default is `0` Time in minutes the account is locked after `maxFailedLoginAttempts` is reached.
`maxFailedLoginAttempts`	optional, default is `5` Number of failed attempts allowed before locking the account.
`realmName`	required Realm name corresponding to JAAS login configuration.

External services

The LDAP Connector module is a standard JAAS login module that connects to any LDAP V3 supported directory service. This module is useful where an enterprise-grade user management infrastructure already exists. With the JAAS standard support you can meet single sign-on requirements or connect to legacy LDAP/ADS directory servers.

Page tree