Access Control restricts a page to specific constituent groups or roles, optionally combining a login requirement with a Passkey Phrase password. This article covers three protection patterns and why Passkey Phrases alone are not recommended for confidential content.
💡Quick answers
- Where is Access Control configured? In Page Settings (gear icon, bottom right) on the Access Control tab.
- What are the three protection patterns available? Log in only (require constituents to log in), Log in + Passkey Phrase (require both login and a password), or Passkey Phrase only (no login required, just enter the phrase).
- Selecting which roles or groups can view a page? Set Who Can Access This Page to Constituents Only, expand the role and group lists, check the appropriate groups, click Save. Logic is OR: belonging to ANY selected group grants access.
- Why is a Passkey Phrase alone not recommended for confidential info? Passkeys can be easily shared, compromising security. Links to public resources or files on the page are still accessible directly. Use a role-protected portal for stronger security.
- Can a Passkey Phrase be combined with login? Yes. Set Who Can Access to Constituents Only, select groups, AND enter a Passkey Phrase. Users must both log in and enter the phrase to view.
When there’s information on your site that you want disseminated to specific groups of constituents at your school, there are ways for you to restrict page visibility to certain groups or roles. This article will show you how it works!
In this Article
Access Control: Password vs Passkey Phrase
The Page Settings gear in the bottom right corner of any page is where you can restrict access of that page to be viewed by only those groups or roles you select.
There are three different ways to restrict a page:
- Log in to gain page access: Require constituent to log in to view content.
- Log in first, then enter Passkey Phrase: Constituent will log in and then view the page by entering a Passkey Phrase.
- Without login, visitor enters Passkey Phrase: Visitor could be anyone who has the link to the page. They view the content on this page by entering the Passkey Phrase.
Important Note
Password protecting a page with a Passkey Phrase offers only limited security and is not recommended for private or confidential information.
- The passkey can be easily shared among users, compromising its effectiveness.
- Additionally, any links on the page to public resources or files will not be protected by the passkey and can still be accessed directly.
For more robust security, consider using role-protected portals as outlined in the article, “Create a role-protected portal”.
To begin, navigate to the page whose access you'd like to restrict. Open up Page Settings and click on the Access Control tab.
Option #1: Log in to gain page access
This option requires a constituent to log in to view page content. Under "Who can access this page?" select Constituents Only where you will then be able to select groups to be included.
- Underneath Roles, all of the groups from Group Manager are displayed.
- Expand out the arrows and select other created Groups from Group Manager.
- Use the checkboxes to select which roles or groups will be able to see this page.
- Click Save.
These selected groups will be able to view the content on this page once logged in.
Important Note
This feature uses "OR" logic, so if you select more than one group, a constituent would only have to belong to one of them in order to view the page (they do not have to belong to ALL groups selected.)
Option #2: Log in first, then enter Passkey Phrase
- To set this up, find "Who can access this page?" and select Constituents Only where you will then be able to select groups to be included.
- Underneath Roles, all of the groups from Group Manager are displayed.
- Expand out the arrows and select other created Groups from Group Manager.
- Use the checkboxes to select which roles or groups will be able to see this page.
- Enter a Passkey Phrase into the blank to set the phrase that people will need to enter.
- Click Save.
These selected groups will be able to view the content on this page once logged in and having entered the correct Passkey Phrase.
Option #3: Without login, site visitor enters Passkey Phrase
You can hide a page from general access without requiring users to log in and only requiring a Passkey Phrase. Here's how it works!
- Under "Who can access this page?" select Everybody or Constituents Only where you will then be able to select groups to be included.
- Enter a Passkey Phrase into the blank to set the phrase that people will need to enter.
- Click Save.
These groups will then be able to view the content on this page once they enter the Passkey Phrase.
Passkey Phrase Warning
Setting a passkey to "Everyone" is not as secure as requiring a login first. Passkeys can be easily shared or leaked, intentionally or unintentionally, which increases the risk of unauthorized access. Passkeys often will not meet security requirements which enhance security and protect content.
Comments
Please Sign in to leave a comment if you don't see the comment box below.