Global Administrators, Subsite User Managers and Subsite Users

There are 3 types of users associated with the Subsite Manager:

1. A global administrator is a person with global administrative permissions.
2. A subsite user manager is a person that can manage users only on a specific subsite.
3. A subsite user is a person who can manage content on a specific subsite only.

The following are operations that each type of users can perform in terms of the Subsite Manager.

Global Administrators

Please note that the global administrators are regular CMS Console administrators not limited by any specific subsite and have maximum permissions system-wide.

With regards to their role with the Subsite Manager, the global administrators can:

• Create and manage subsite stencils
• Add and delete subsites
• Edit subsite administrators' settings
• Do all the operations allowed to subsite user managers (see below)

Subsite User Managers

The subsite user managers can:

• Manage subsite users (add, edit and delete subsite users)
  (If C1 users are managed elsewhere (for instance in Azure AD) the below information is not relevant.)
  
• Do all the operations allowed to subsite users (see below)

Subsite Users

The subsite users can:

• Manage content on a specific subsite (add, edit, delete, pages and media files, publish pages, etc)
• Change their own passwords
  (If C1 users are managed elsewhere (for instance in Azure AD) this information is not relevant.)

Please see the "ManageUsers" attribute on stencils - this allow you to control if the Subsite Manager should manage users for you.

If your users are managed elsewhere, like Azure AD, you should set "ManageUsers" to false and manage group memberships yourself. How this is done depends on the external user environment.

Creating and managing subsite stencil

Subsites are created by the global administrator from a subsite stencil.

The subsite stencil includes:

• a subsite with associated page data folders, meta data and applications
• one or more media folders
• one or more local user groups
• 2 global user groups to access CMS Functions ("function readers") and shared media ("media readers")

You can specify media folders that should be copied on website creation if necessary. 

If images and other media files are used on the stencil website, the media folders they belong to should be specified so that they would be copied and their copies used on the created website instead. If not, they will be in use on the subsite but not accessible to the subsite users.

You can however assign specific media folders and files to the "media readers" global user group thus making these media accessible to subsite users and shared between subsites.

First of all, prepare the above-mentioned components for a stencil in the corresponding perspectives:

1. Log in to the CMS Console as a global administrator.
2. In the "Content" perspective, make sure there is a subsite that will serve as a subsite stencil. If not, create one.
3. In the "Media" perspective, make sure there are one or more media folders with files that you want associated with the stencil. If not, create them.
4. In the " System" perspective, make sure:
   1. There is a user group that will be copied to serve as the subsite user manager role.
   2. There are one or more user groups that will be copied to serve as one or more subsite user roles (for example, “editor”, "publisher" etc).
   3. There is a user group ("function readers") to give access to CMS Functions to.
   4. There is a user group ("media readers") to give access to media folders and files to be shared between subsites.
5. Assign to user manager and subsite user groups (4.1 and 4.2 above) the permissions that you want the resulting roles to have on the subsite. The global permissions assigned here will "become" local permissions - at the level of the subsite.
6. Don't assign any global permissions to the "function readers" and "media readers" groups (4.3 and 4.4 above) but do the following:
   1. In the "Functions" perspective, edit local permissions on "All Functions" and grant the "function readers" group the "Read" permission.
   2. In the "Media" perspective, edit local permissions on media folders and / or files and grant the "media readers" group the "Read" permission where necessary.

The copied user group set as a user manager group in a stencil will be assigned the "Configure" permission at the level of the subsite even though it will not be set in the user group it is copied from.

All the created users on the subsite will be assigned to the "function readers" and "media readers" groups to have access to CMS Functions and to any media folders or files shared between subsites.

Next, configure the stencil in the Subsite Manager configuration file:

1. Log in to the CMS Console as a global administrator.
2. In the "System" perspective, edit ~/App_Data/SubsiteManager.config.
3. Below <Stencils> add a <Stencil></Stencil> element.
   1. In the HomePagePath attribute, specify the path to the home page of the subsite that will serve as a stencil.
   2. In the UserManagerGroup attribute, specify the user group a copy of which will serve as the subsite administrator role.
   3. In the ManageUsers attribute, specify is C1 users should be created as part of new sub sites. Specify "false" is users are not managed in C1 CMS.
4. Below the <Stencil> element add a <MediaFolder/> element and, in its Path attribute, specify the relative path to a media folder you want to copy with the stencil. Repeat this step for as many folders as you need.
5. Below the <Stencil> element add a <LocalUserGroup/> element and, in its Name attribute, specify the user group you want to copy with the stencil. Repeat this step for as user groups as you need.
6. Below the <Stencil> element add a <GlobalUserGroup/> element and, in its Name attribute, specify the user group you intend as "functions readers". Repeat this step for the "media readers" group.
7. Save the file.

<Stencils>
	<Stencil HomepagePath="/" UserManagerGroup="User Manager" ManageUsers="true">
		<LocalUserGroup Name="User Manager" />
		<LocalUserGroup Name="Developer" />
		<LocalUserGroup Name="Publisher" />
		<MediaFolder Path="/Office" />
		<GlobalUserGroup Name="Media Readers" />
		<GlobalUserGroup Name="Function Readers" />
	</Stencil>
</Stencils>

You can repeat the above steps for as many stencils as you need.

Deleting a stencil from configuration

Please note that if you delete a stencil from configuration, any new users you will afterwards add to a subsite created from the deleted stencil, will not belong to the "function readers" and "media readers" groups. You will need to give them read permissions to CMS Functions and any shared media manually.

Updating the subsite stencil

The subsite stencil is a hierarchy of pages and page folder data, which you can manage directly in the CMS Console in the "Content" perspective. Only global administrators have access to change the subsite that serves as a stencil.

Since the subsite stencil is what will be copied when new subsites are created, any change here will be visible on new subsites. Changing anything here will not affect existing subsites.

Updating the media folder stencil

The media folder stencil is a hierarchy of media folders and media files and you manage these directly in the CMS Console in the "Media" perspective. Only global administrators have access to change the media folder that serves as a media folder stencil.

Since the media folder stencil is what will be copied when new subsites are created, any change here will be visible in the media folder structure related to new subsites. Changing anything here will not affect existing subsites.

Adding a subsite from a subsite stencil

Only global administrators can add a subsite from a stencil.

1. Log in to the CMS Console as a global administrator.
2. From the "Content" perspective, select "Websites" and click "Add Subsite from Stencil".
3. In the wizard that opens, set the values in the following fields:
   1. Subsite Title: The title of the subsite. It will also be the title of the site's root page.
   2. Stencil to Copy: The subsite stencil to create a site from.
4. Click "Next".
5. On the next page of the wizard, fill the following fields if necessary:
   1. Path: The basic path name to the subsite (typically title without spaces and other non URL characters). By default, pre-filled with a cleaned version of the subsite title.
   2. Username: The user name (login) for the subsite user manager. By default, pre-filled with a cleaned version of the subsite title.
   3. Password: (required) The password for the subsite administrator
   4. Name: Name of the subsite user manager. By default, pre-filled with the combination of the subsite title and "Administrator"
   5. Email Address: The email address of the subsite administrator.
6. Click "Finish".

As a result, a subsite will be created in the "Content" perspective. Below the subsite's home page there will be the "Subsite Users" node with a subsite user manager added. Here a subsite user manager can add or edit other subsite users.

In the "Media" perspective, a media folder named after the susbite will be created and media folders defined for the subsite will be copied here.

Deleting a subsite

Only global administrators can delete a subsite created from a stencil. This operation is identical to a normal page deletion. To delete the subsite:

1. Log in to the CMS Console as a global administrator.
2. From the "Content" perspective, expand "Websites".
3. Select the subsite's home page and click "Delete" on the toolbar.
4. Confirm deletion of associated data if prompted.

Editing subsite user managers' settings

If C1 users are managed elsewhere (for instance in Azure AD) the below information is not relevant.

All subsite users are normal Orckestra CMS Users and can thus be managed in the System perspective below the "Users and Permissions" / "Users".

Only global administrators can change settings of a single user manager of a specific subsite. The subsite user managers can manage other user managers and users of the subsite in a limited way.

Adding subsite users

If C1 users are managed elsewhere (for instance in Azure AD) the below information is not relevant.

A subsite user manager can add, change settings of, or delete subsite users. When a subsite is created, the subsite user manager will be created by default.

1. Log in to the CMS Console as a subsite user manager.
2. From the "Content" perspective, expand "Websites", then the subsite and select "Subsite Users".
3. Click "Add New Subsite User".
4. Fill the fields:
   1. Username: Required.The username (login) for the subsite user.
   2. Role: Required. The one of the pre-defined roles (user groups) for new users, for example, "Subsite User Manager", "Subsite Publisher", “Subsite Editor". This controls what subsite-specific user group the user is added to, hence the permissions this user will have on the subsite.
   3. Password: The password for the subsite user. Not prefilled, required field.
   4. Name: The name of the subsite user.
   5. Email Address: The email address of the subsite user.
5. Click "Save".

Here, you can also edit the subsite and delete subsite users provided you are logged in as a subsite user manager.

Managing content on subsites

All subsite users can only manage content (pages, associated data and media files and folders) on their subsite provided they have the proper permissions ("Edit" etc). The content management is identical to normal content management in Orckestra CMS.

Changing passwords

If C1 users are managed elsewhere (for instance in Azure AD) the below information is not relevant.

The logged-in subsite user can change his or her password in a regular way - via the main menu: "Tools" / "Change Password".