Figure 5-15. The User Manager maintains the user login accounts. in VB.NET

Maker Code 39 Extended in VB.NET Figure 5-15. The User Manager maintains the user login accounts.

s Note User authentication is not limited to the Joomla system. Joomla includes a number of plug-ins that interface with other systems (such as for LDAP and Gmail authentication). If you would like to bridge the user login privileges from another system, particularly if you re unifying Intranet infrastructure, see the Joomla documentation for configuration details for these extensions.

At the lowest security level, on the Your Details screen the user can only modify the name to be used on the site, the e-mail address, the username, the password, and the editor (e.g., TinyMCE) that will be used when content editing is granted.

The setting that allows users to register without administrator approval can be set either in the Site panel of the Global Configuration Manager or through the Configuration button in the User Manager. When the Configuration button is clicked, the settings available for the registration system are displayed (see Figure 5-16).

CHAPTER 5 s ADMINISTERING JOOMLA!

Figure 5-16. In the User Manager, clicking the Configuration button will display the Edit Configuration window.

The administrator can freely modify all settings pertaining to the user account, as well as disable or delete the account if necessary. The Filter drop-down lists on the right side of the User Manager let you separate out all but logged-in users or display the users based on the group to which they belong. Note that unlike other security systems, Joomla users may not belong to more than one group at a time.

s Caution If you decide to delete a user record that is linked to a record stored by the Contacts plug-in, you will orphan the contact record. Therefore, after deleting a user record, be sure to check the Contacts list to make sure that there is not a dangling record there.

One of the key aspects of creating a community site is the management of users. Everything from slovenly account request response to malicious cloning of a user s account can lead to distrust from your user base. Be sure that you take user security and responses to authorization requests seriously.

Joomla provides anonymous access for everyone and basic login security for registered users. The types of users that will access the Joomla site are broken down into three basic groups:

CHAPTER 5 s ADMINISTERING JOOMLA!

Unregistered users: These users are simply visitors to the web site who haven t logged in and may not be registered. Most simple web sites don t have a registration system, so all of the users of such a web site would fall into this category. These users are also called public front-end users. Registered front-end users: These are readers of your site who log in to gain access to restricted content. A registered user account may be activated after filling in a simple form, receiving a confirmation e-mail, or being manually confirmed by an administrator. Content on a Joomla site can be restricted to registered users. Some pay sites such as Salon.com provide articles available only to subscribers who pay a monthly fee. Registered users may be authorized to contribute content to the site, but adding new content is the limit of their permissions. Registered back-end users: These are contributors, system administrators, or moderators who have the ability to log in and modify core portions of the site itself. Their ability to make changes to the site is determined by the permissions granted. These users have access to the administrator back-end. When you edit a user account in the User Manager, as shown in Figure 5-17, you can see these three categories present in the Group list box. Two of these general categories (registered front-end and back-end users) have subcategories that further define the privileges of the user account.

Figure 5-17. Editing a user record from the User Manager allows the administrator to assign the user to a group.

CHAPTER 5 s ADMINISTERING JOOMLA!

Registered Front-End Users When registered front-end users are given modification privileges, they can access the WYSIWYG editor to post or edit articles. The four subgroups that are held under the registered front-end users category have varying submission capabilities. The four types of front-end users are as follows: Registered: Simple registered users have the ability to read restricted content (if available on the site). They have no capabilities to submit new content articles, although they may submit web links. Author: Members of the author group can post and modify their own articles. They can even determine when the article will be published (limited by the administrator s ability to have a moderator set up who must clear any posted content before it appears). Editor: Like an author, a user in the editor group can post and modify their content. An editor also has the ability to edit other contributors content. Publisher: A user with publisher status can perform any operation available to an editor, but may also publish or unpublish content on the site. If the user account was created through the front-end Joomla interface (rather than by an administrator or super-administrator) by the user filling out a registration form, Joomla can be set to send a confirmation e-mail to the user to ensure that the e-mail address is valid. Joomla handles all of this work, and this feature is enabled by default.

Registered Back-End Users Registered back-end user groups contain the various administrative users of the site. Administrators have the ability to change access and permissions, alter the site template, create new sections and categories, install new components, and other functions. The three groups for back-end users are as follows: Manager: The manager group has the lowest authority in the administrative pyramid. Members of this group have limited access to the administrator Control Panel, and can confirm registration for users and perform basic maintenance such as categorizing an article or managing sections and categories.

CHAPTER 5 ADMINISTERING JOOMLA!

Administrator: The administrator can install and uninstall extensions to the Joomla system, change the selected template, change the layout of a page, and modify the permissions of any user lower than their access level. An administrator does not have the power to edit a super-administrator user record (obviously), edit the global configuration, access the mass mail capabilities, or install templates or languages. The administrator level and above are the only groups that can create or authorize new registered users. The Joomla system can be configured to allow a user s automatic registration into the system, but the limits on a user-registered account are determined by administrator settings. Super-administrator (SA): The SA is the king of the web site. Like the administrator level on Windows and the root or sa user level on Linux, the SA has no restrictions on the system. The SA account is the one created during the initial Joomla installation. This account traditionally has a username of admin. When accessing the Joomla Administrator interface, the user s group designation will determine how the interface appears. The interfaces for the lower-level groups (such as manager) are missing many of the buttons and menu items that are present when an SA is logged into the system.

Lost Password If a user loses their password, the Joomla interface can request a reminder be sent to the registered account s e-mail. Passwords are stored encrypted in MD5 format, so they cannot be recovered easily. If a password is lost, it should be reset by an administrator. The new password will only be sent to the e-mail address that was registered with the account. If the user has closed down that account or is no longer able to access it, the SA must be contacted to do a special individual reset.