diff --git a/Documentation/PermissionsManagement/GroupsInheritance/Index.rst b/Documentation/PermissionsManagement/GroupsInheritance/Index.rst new file mode 100644 index 00000000..b55c2628 --- /dev/null +++ b/Documentation/PermissionsManagement/GroupsInheritance/Index.rst @@ -0,0 +1,23 @@ +.. include:: /Includes.rst.txt + +.. index:: backend, acl, permissions, user groups, user management + +.. _groups-inheritance: + +================== +Groups inheritance +================== + +Even though TYPO3 does not limit the depth of backend user group inheritance, +it's advisable to avoid complex setups. Typically, 1 or 2 levels of inheritance +should suffice. Such flat structures offer significant advantages over more complex, +deeper inheritances, including easier maintenance, updates, and verification +of the sources of specific permissions. + +.. uml:: _simple-groups-inheritance.plantuml + :align: center + :caption: Backend groups hierarchy with 2 levels of inheritance + :width: 700 + +.. note:: + Avoid complex inheritance within backend user groups. One or two levels of inheritance should suffice and make permissions easier to maintain. diff --git a/Documentation/PermissionsManagement/GroupsInheritance/_simple-groups-inheritance.plantuml b/Documentation/PermissionsManagement/GroupsInheritance/_simple-groups-inheritance.plantuml new file mode 100644 index 00000000..41a80dec --- /dev/null +++ b/Documentation/PermissionsManagement/GroupsInheritance/_simple-groups-inheritance.plantuml @@ -0,0 +1,46 @@ +@startuml +skinparam defaultTextAlignment center +skinparam nodesep 10 +skinparam ranksep 20 + +rectangle "User" AS User #Motivation { +} + +rectangle "First level" AS First_Level #line.dotted { + rectangle "R_role_group" AS R_role_group #Implementation { + } +} + +User <-down- First_Level + +rectangle "Second level" AS Second_Level #line.dotted { + rectangle "System Groups" AS System_Groups #line.dotted { + rectangle "PG_website_a" as PG_website_a #Application + rectangle "DBM_website_a" as DBM_website_a #Application + rectangle "FM_website_a" as FM_website_a #Application + rectangle "CM_website_a" as CM_website_a #Application + rectangle "FO_all" as FO_all #Application + rectangle "L_all" as L_all #Application + PG_website_a -[hidden]-> DBM_website_a + DBM_website_a -[hidden]-> FM_website_a + FM_website_a -[hidden]-> CM_website_a + CM_website_a -[hidden]-> FO_all + FO_all -[hidden]-> L_all + } + + rectangle "ACL Groups" AS ACL_Groups #line.dotted { + rectangle "ACL_content_elements" as ACL_content_elements #Technology + rectangle "ACL_news" as ACL_news #Technology + rectangle "ACL_gallery" as ACL_gallery #Technology + rectangle "ACL_survey" as ACL_survey #Technology + ACL_content_elements -[hidden]-> ACL_news + ACL_news -[hidden]-> ACL_gallery + ACL_gallery -[hidden]-> ACL_survey + } + + System_Groups -[hidden]right-> ACL_Groups +} + +First_Level <-down- Second_Level + +@enduml \ No newline at end of file diff --git a/Documentation/PermissionsManagement/Index.rst b/Documentation/PermissionsManagement/Index.rst index 5816bfbb..fac8bea4 100644 --- a/Documentation/PermissionsManagement/Index.rst +++ b/Documentation/PermissionsManagement/Index.rst @@ -108,3 +108,4 @@ the naming convention for backend groups later on. GeneralRecommendations/Index SettingUpBackendGroups/Index ExampleConfiguration/Index + GroupsInheritance/Index