User Lists - Access Control 25 min

Access control lets you apply security to your website, either to restrict access to specific pages or to
control user access to forums, blogs, and other Serif Web Resource features. In WebPlus, this is
managed with a User List Smart object.

By the end of this tutorial you will be able to:

 Set up access control.

 Create and manage user groups.

 Apply page security.

 Suspend and block IP addresses and users.

 This tutorial assumes that you have already registered for a Serif Web Resources account as you
will need to log in to access the Smart objects. If you are unsure how to do this, see the
tutorial Serif Web Resources or see WebPlus Help.

To download the tutorial project file(s), right-click the link(s) and, depending on your
browser, select either Save Target As...or Save Link As... In the subsequent dialog, ensure
that you choose a suitable file location, such as a 'downloads' folder or the 'desktop', so that
you can easily browse to your file when required.

portfolio.wpp

Let’s begin...

1. On the Standard toolbar, click Open.

2. Navigate to the portfolio.wpp file, select it and click Open.

Save now! Click File > Save As... and choose a new name for your file.
Setting up access control

There are often times when you want to restrict access to certain pages within your site, e.g., a photo
gallery or to members only section. This is where the User List Smart object can help.

The User List Smart object has two modes—Access Control and Mailing List. The User List -
Access Control mode lets you apply security across your site (typically to specific pages of your site).
In this exercise, we'll set up an Access Control Smart object to set security on our gallery page. Once
we've done that, we can reuse the access control for our forum in the next tutorial.

1. To set up access control:

On the Insert menu, click Smart Object. If necessary, log in to your account.

2. In the Smart Objects dialog, click New...

3. In the Create Smart Object dialog, select the User List option and click OK.

4. In the User List dialog, click Access Control.

5. In the following dialog, name your access control object—it may be helpful to include the
name of the website, e.g., portfolio access.

6. If you want to create an on-the-page user login, set the properties of the text, buttons,
background, and border. You can also edit these at a later date.

6. Click Create. Your new Smart object is listed in the Smart objects Library.
Adding users to the User List

Access control is based around a user list (i.e., a complete list of users who are registered on your
site) and one or more user groups. Users can be added to the user list in two ways:

 Automatically - when a visitor registers or signs up on your site or forum.

 Manually - by adding a user in the Manage dialog. This is most useful when you want to restrict
access to pages on your site and you have a dedicated list of people to add immediately.

As we are going to password protect one of our pages, we'll start by manually adding some users to
the list. Let's do this now.

To manually add a user to the User List:

1. In the Smart object library, select your User List - Access Control Mode object and
click Manage.

The Users section already contains one user—this is your Serif Web Resources login email
address.

2. In the Add New User section, type the user email address into the Email field.

3. Leave the default settings (recommended) and click Add User.

The user is added to the list and will receive a confirmation email with their login details and a
 link which they will need to click to activate their account.

4. Add any other users.

 If you clear the Require Activation check box, the user is automatically activated. They will
immediately be able to log into any page that uses this specific access control object.

Top of page

Configuring access control

Now that we've created a new User List Access Control object, the next step is to configure our users
and groups.

To create user groups:

1. If necessary, in the Insert menu, click Smart Object and log in.

2. In the Smart Objects Library, select your User List - Access Control Mode object and
click Manage.

3. In the Manage dialog, click the Groups tab.

Currently, the list of groups is empty. As we are going to set security on our gallery page, let's create
a 'Gallery access' group.

4. Under Create New Group:

o Type 'Gallery access' in the Group Name box.

o Ensure that the Add new users on signup option is cleared.

 o Click Create Group.

o If a page is for general use, but you still want to maintain overall control of who views or uses it, use
can the Add new users on signup option. This is especially useful to control access to forums as you
will often want to allow anybody to sign up and post, but control the permissions of various users. See
the tutorial, Forums, for more information.

5. The Group Management panel displays the settings that you've just created. For now,
click Done.

6. In the User Group Management pane, the Group drop-down list displays the name of your
new group.

Notice that the group list is empty. Let's now add some users.

To manually add users to a group:

1. On the Groups tab, ensure that your new group is selected.

2. To add users one at time:

o In the Users section, click to select a user name from the list.

o Click Add.

- or -

To add all users in the list, click Add All.

3. Once added to the group, the users appear in the group list.

4. Click Exit once to exit the dialog and again to exit Serif Web Resources.

Now that your 'Gallery access' control group is created, we can set up the page security on our
'Clients' gallery page. Let's do this now.

To apply page security:

1. On the Site tab, double-click the Clients page entry.

2. On the Pages context toolbar, click Page Security.

3. In the Page Properties dialog, click the Page Security category and select the Protect page
with passwordoption. Click Change/Manage.
4. In the User Groups dialog, select the 'Gallery access' group and click OK.

1.
Back in the Page Properties dialog, the 'Gallery access' group is displayed next to the Current
User Group field. Click OK to exit.

2. In the Site tab, a key icon is displayed on the 'Clients' page.

3. To test your security changes, publish your site to disk (File > Publish Site > Publish to Disk
Folder...) and then view the 'Clients' page in your browser. An Authentication Required dialog
will appear. Log in to access the page.

 You can use access control to apply security to other pages of your site, such as those containing
confidential information. If you have several pages to protect, why not add an access control login
object to your master page? For more details, see WebPlus Help.

Congratulations! You've successfully created an access control user list and used it to protect your
page.

Don't forget to save your work!

Top of page

Suspending and banning users

Your User List - Access Control object can be used by any smart object that requires a user list. To
make access control useful, you also need to no how to remove, suspend or ban users from a group.

In the Manage dialog, the User Control section allows you to suspend users temporarily or ban
them entirely.

 Why suspend users?

Suspending users temporarily disables their username (email address). You may want to do this for
various reasons e.g., if their club subscription has expired and you want to suspend members only
access until they renew, or by way of punishment for posting defamatory statements on a hosted
public forum.

To suspend a user:

1. If necessary, in the Insert menu, click Smart Object and log in.

2. In the Smart Objects Library, select your User List - Access Control object, then click Manage.

3. In the Manage dialog, click the Bans tab.

4. Under User Control, select a user from the Email drop-down list.
 5. Click Suspend User.

On the Users tab, in the Users list, suspended users are indicated with an asterisk.

The next time the user tries to log on, the message "Your account has been suspended" is
displayed.

To reactivate a suspended user:

 Select the user and, on the Bans tab, click Unsuspend User.

 Why ban users?

Suspending users does not prevent them from registering or logging in with a different username. If
more drastic action is required, a user's IP address can be banned from accessing the forum. As a last
resort, even the ISP or organization to which the owner of the email address belongs can be banned
to prevent institutional malpractice such as professional spamming. As a general rule, the latter option
is not recommended.

To ban a user by IP address:

1. If necessary, in the Insert menu, click Smart Object and log in.

2. In the Smart Objects Library, select your User List - Access Control object, then click Manage.

3. In the Manage dialog, click the Bans tab.

4. In the Ban User's drop-down list, select IP address.

5. Click Ban.

 Banning a single IP from America Online may also affect other users.

To ban a user by ISP or organization:

1. If necessary, in the Insert menu, click Smart Object and log in.

2. In the Smart Objects Library, select your User List - Access Control object, then click Manage.

3. In the Manage dialog, click the Bans tab.

4. Click the Lookup User button.

Serif Web Resources locates the user's ISP/organization network address and displays it in the
scrolling window.

5. As the Lookup User function relies upon external websites (those responsible for allocating IP
addresses), it may sometimes fail due to timing out.

5. In the Ban User's drop-down list, select ISP/organization.

6. Click Ban.

 Banning an ISP or organization can result in innocent visitors to your site also being banned. It is
recommended that you only apply an ISP ban as a last measure.

 If a user's IP address, ISP, or organization is banned, it is listed in an Unban drop-down list. The entry
will also include the date the address was banned. This allows you to review current bans and reverse
them if the user, IP address, or organization is no longer considered suspect.

In this tutorial, we've shown you how to set up an access control user list object, which we will use in
the next tutorial, Forums. However, the User List object has another function—mailing lists. See the
tutorial, User Lists - Mailing Lists, for more information.