Umbraco 7 back-office user access control

Question

This issue may have a bearing on whether we use Umbraco for a given company or use something else.

The company has both an intranet and web site(s) running on an old bespoke system which is scheduled to be replaced.

Having tested Umbraco extensively and built mock-up sites, I am very impressed with its flexibility, and I strongly suspect it would work for the web estate.

However,the intranet is first to be replaced and, as per an earlier post, the issue is here that that are a number of document types that comprise the intranet, and any one of the employees (and there are thousands) can create, publish and edit their own documents, but can't edit documents created by other users.

Also, they will have logged in to Windows and don't wan't to log in to again to edit documents in the intanet CMS.

The questions are

Can users be automatically logged into Umbraco back-office by intergrating with Active Directory?

If so, can this handle thousands of such users?

Is there any way of preventing users from editing each others' documents (as far as I can see, if we allow users to create, update and publish, they can edit documents created by other users as long as the documents are under their starting node). I suppose we could make a staring node for each user and all their documents go under that - but then this would make the node structure massive, unmanageable, and, I suspect, slow.

Admins should be able to edit anything.

Reading the above back it looks very much to me that Umbraco just isn't suitable for an intranet (and to be fair, it's not promoted as such), but its user access system is it's big failing. and I think it might make it a non-starter....

Answer 1

about Active Directory I answered your question in your 2nd thread here: Umbraco - members creating back-end content.

Regarding your concerns about Tree structure and blocking content, you can restrict permissions for each user to allow or dissalow specific actions for specific node (with / without children nodes).

Of course, it depends from requirements and desired solution. If you want to have shared three, but block some actions for specific users - this is the way. If you don't want to allow other users to even see structure of trees managed by other users - it will be better to create different parent nodes for them and restrict access only to those one.

The same options are visible when you right click on node and choose "Permissions".