Archive for the ‘Security’ Category

What is Single Sign On?

Single Sign On will allow you to open other applications within ’My Imperial’  by logging in only once.  It will give you the ease of accessing all favourite applications with only a click of the button!

How does this work?

The first time you use ‘My Imperial’  to link to other applications you may be asked to login.  If so, enter your username and password for this application and it will open normally.  The next time you click on the link or the icon it will automatically log you in.

When a password has changed on an application

You will be asked to enter in your username and password.  Once you have logged in again with your new username and password then it will not be necessary to enter it again unless your password changes or expires.

Is Single Sign On secure?

The whole login process has been approved by the College’s  ICT Security team and your details are protected.

Simple permission setting for a single page can be done using the ‘Access’ link in the footer. However, sometimes you need to set permissions for a set of pages and a ‘bulk update of permissions’ can be useful.

How to perform a bulk update of permissions

1. You set permissions for a set of pages by logging in on the parent page of the pages you are working on, and going into the ‘Edit’ view of the page.

2. Then go into the ‘List’ view of the page by clicking the ‘Editing Views: List’ link top left under the site banner e.g

You will see a list of the sub-pages and the items for this page.

3. Select the required sub-pages by ticking them. Note that you can only tick the links with a yellow folder icon against them – these are pages. The links with a ‘document’ icon are items within a page and you cannot set permission at item level. Now select the action you want to carry out on the selected pages. In this example they are set to inherit their permission from their parent page.

4. Click on ‘Go’ and the permissions will be adjusted for the selected pages. If you have chosen the ‘Modify Access Settings’ option you will get a page with a ‘Grant Access’ form to enter the name of the user/group to be added to the permissions for the pages.

5. Click on the ‘Editing Views: Graphical’ link to get back to the usual Edit view of your page, or on the ‘View page’ link top right below the blue banner to see the page in the normal browser view.

User groups are pre-defined entities to which a group of users are assigned. User groups can be granted different access permissions to different pages.

If you are the owner of a user group, for example, a user group for a research group, you can manage the membership of the group. If you choose to add members to a user group remember that they will be able access/edit all pages available to the group.

IMPORTANT: If you are the owner of a group and wish to give a user permission to edit one or two pages in your area consider granting manage access to those specific pages to that user (see Setting Permissions). A user added to your group will be able to manage all pages in your area.

To add users to your user group:

• Browse to a page and click the Edit link at the bottom of the page. If you cannot see the Edit link then you are either not logged in or do not have manage permissions for this page.
• In the graphical editing view page displayed select the Builder link the toolbar at the right.
• In the Portal Builder page that appears click the Administer tab on the right.
• On the right of the Administer page click the browse groups button shown below.

You will now see those groups in which you are an owner. Select the group you wish to edit and press Select.

Then click the Edit button. See also Group Naming Conventions.

The group editor page will now open. You can add users to the group either as other owners (who will be able to edit the group membership) or as group members (who cannot edit the group membership). To add a member or an owner to the group click the appropriate Add User button.

The user browser will now open. Enter the surname or email name of the user you wish to add to the list. Select the user from the list and press Select. You can add as many owners or members to the group as you wish. To save the added users to the list press the Submit button, and then Done.

Pages in a website can be hidden from the view of the public and restricted to people with a College login. They can even made viewable only by specific groups of users within a department or team. Currently, a page that is hidden from the public will still appear in the right hand navigation bar when viewed by a user who is not logged in, although they will be prompted for a College username and password if they click the link. 

When a new page is created (see Adding New Pages) it can be hidden from the public by ensuring the Display Page to Public checkbox is not selected on the Access page of the new page wizard. New pages inherit the access permissions of their parent page. If the parent page can be viewed by the public then the Display Page to Public checkbox will be selected in this checkbox by default.

Although a page has been hidden from the public this does not mean it is necessarily viewable by all internal College users. To make the page viewable by specific groups of users you need to grant VIEW access permissions. See Changing permissions for further information. The following standard user groups are an example of useful groups in this case for the Earth Science and Engineering website. Similar groups exist for other departments.

• IMPERIAL-USERS- all internal users
• ESE Users – all ESE staff and students
• ESE Staff – all ESE staff

To hide an existing page from the public, browse to the page and click the Edit link at the bottom of a page. If you cannot see this link then you are either not logged in or you do not have manage permissions for this page. You will now see the graphical editing view for the page.

Select the Page: Properties link in the toolbar at the top of the page, and click the Access tab on the page that is displayed. To hide the page from the public simply ensure that the Display Page to Public checkbox is not selected.

Once a page has been hidden from the public this does not mean it is necessarily viewable by all internal College users. To make the page viewable by specific groups of users you need to grant VIEW access permissions. See Changing permissions for further information.

All new pages created in a directory (i.e. from a single parent page) will inherit the permissions of the parent page automatically. The permissions of a new page can, however, be changed when it is created or at some later time. It is also possible to change the permissions on a number of pages at once.

You can set the access permissions of a new subpage when creating the page (see Adding New Pages). When creating a new page the last page of the wizard is the Control Access page. Permissions are set in the Grant Access section. Permissions can be granted to groups using the browse groups button.

This will display the groups browser. To find the group you can search for the group in the browser by entering, for example, “e-dep-bioeng” in the search box – this will display all groups belonging to Bioengineering. Other groups derived from the College Directory can be found by setting “All” instead of “Local” in the search dropdown. See also Group Naming Conventions. The group “imperial-users” contains everyone with a College network login.

To select a group in the groups browser click the radio button next to the group name and click the Select button. The groups browser will close and add the group to the Privilege list under Change Access.In the example shown above, “E-DEP-BIOENG-M” refers to the Department of Bioengineering; “MMHOLL” is an individual user. Both have permission to manage the site. Note that if the page had been made visible to the “imperial-users” group,  or was visible to the public, it would not normally be necessary to apply any further view permissions.

You can grant access permission to an individual user by using the browse users button in the Grant Access section.

This will display the user browser. Enter the surname or email address of the user in the search box to find a user, then select them from the list. As with groups, that user will now be added to the Privilege list and their permission level set.

Clicking the red cross in the Change Access area next to a group or user will remove the set privilege of that group or user.

In the Change Access area you can select which the different permissions levels or privileges you wish to to grant that group over this page (and any subpages of the page that may be added later.) See Setting Permissions for information on the different permission settings.

To change the permissions on a page, browse to the page in the website and click the Access link at the bottom of the page. If you do not see the Access link then you either are not logged in or do not have manage permissions (see Obtaining Permissions).

You will now see the Access tab of the Page Properties.

Set the permissions for groups or individuals using the methods described above for new pages.

If you think you should be able to edit a certain page in the website and would like to obtain the permissions to do so contact one of the following:

• the site owner – you may find their details in the Access section
• the Faculty Web Officer
• the Service Desk should be able to give you the name of the site owner.
• if the site owner has left and you are taking over ownership of the site contact the Service Desk to request set up of your permissions.

The number of groups is too large for the full list to be displayed, so you will need to specify the first few characters of the group name to limit the number of results which are returned.

Some examples of group names are:

• a-dep-ict-services-m: Managers of the Services section of the ICT site (never delete this group from your site, otherwise ICT will be unable to log in and help you if you get stuck!)

• b-res-entrepreneur-admin: People with permission to administer navigation settings for the Business School/ Entrepreneurship research group site

• e-engineering-m: Managers of the Faculty of Engineering

• p-physicalsciences-all: All staff working in the Physical Sciences Faculty office

The first letter identifies the Faculty or type of operating unit:

• a: Administrative divisions and central departments e.g ICT, Library
• b: Business School
• c: Cross-faculty or non-faculty Centres
• e: Engineering faculty, departments and research groups
• g: Graduate Schools
• h: Humanities
• n: Natural Sciences faculty, departments and research groups
• m: Medicine faculty, departments and research groups

Before the creation of the Natural Sciences faculty, there were two other faculties. Some groups exist which were created at that time i.e. those starting:

• l: Life Sciences faculty, departments and research groups
• p: Physical Sciences faculty, departments and research groups

The second part is sometimes used to denote the type of site:

• dep: for departmental sites
• res: for research group sites

In other cases it is the site name

Subsequent parts of the name identify sections within the site which need different permissions.

The final part of the name is often used to show the type of permission the group will be assigned:

• m: People with Manage permission
• v: People with View permission
• admin: People with permission to configure the navigation settings e.g. hiding pages

Raise a request through the Service Desk asking for the Web Support team to reinstate your permissions.

No, raise a request through the Service Desk asking for the Web Support team to create the groups you need. You will be set up as the Group Owner so you can add owners and members to the groups. You  can assign the group’s permission to different pages in your site.

Every page in the website has a variety of permissions associated with it that determines who can view, edit, delete, move, copy the page etc. The permissions are:

• Manage – complete control, you can edit, delete, rename a page, add new subpages, change its access permissions. 
• Manage content – allows editing and deletion of content on a page, does not allow creation or deletion of subpages. 
• Manage items with Approval – allows editing of an item (content holder on a single page) but with final publication being approved by the page owner (i.e. those with manage permission) or a designated approver.
• View – allows viewing of a page only.

Permissions on any page can be assigned by those with manage permissions, to either user groups or individual users. New subpages inherit the same permissions as their parent page when they are created. Changes to the parent page permissions will cascade down to sub-pages if they are set to ‘Inherit from parent’. Otherwise they must be applied using the bulk permission process.

A group is a pre-defined set of people that starts with an owner. The owner of a group can add other owners – who also have permission to add and remove users – and members whose permissions can be set individually by the group owners (see Managing User Permission Groups ). An individual user can be anyone with a College login.

To select the required group to edit, or when assigning permissions, it is useful to know the group naming conventions.

One useful group is imperial-users which is everyone with a College network login. Use this group to restrict access to people within the College community.