Set access rights with Opti ID

24 min

This topic is for CMS administrators and developers with administrative access rights.

Opti ID is Optimizely's single sign-on platform that unifies authentication and access management across Optimizely products, including CMS 13. Administrators manage users, groups, and roles for all products in one place. Editors sign in once and switch between products without re-authenticating. See Overview of Opti IDOverview of Opti ID for the full feature list.

Access rights with Opti ID involve two systems. Opti ID handles user identity: who exists, what groups they belong to, and what roles they hold. CMS 13 handles content authorization: what specific permissions each role grants on each piece of content. Administrators configure both sides for an editor to access the right content. This configuration also requires administrator access in Opti ID.

Access rights in CMS 13 control the content visitors see, what editors can do, and where they can do it in the content structure. For example:

Give members of the marketing department access to edit website marketing material that other users should not edit.

Set access rights for many content types (pages, blocks, images, and documents) and in the navigation and assets panels.

Access rights also work with audiences. For example, grant a local audience access to a specific advertisement page.

When a user with an Opti ID role signs into CMS 13 for the first time, the role syncs to CMS 13 and becomes available for access rights assignment. Access rights with Opti ID follow this three-step workflow:

Create a custom role in Opti ID, or use a built-in role such as Content Editors.

Assign the role to individual users or groups in Opti ID.

Set access rights for the role in CMS 13 to control its permissions on content.

If your organization does not use Opti ID with CMS 13, see Access rights without Opti ID.

Manage access rights from the administration page in CMS 13. You can also give editors the right to manage access rights for a single page from the Publish or Options menu.

CMS 13 access rights work together with Opti ID roles, where you define the access rights (read, create, change, delete, publish, administer) and assign them to a specific Opti ID role in CMS 13. Then, you assign that Opti ID role to users or groups in Opti ID.

Built-in user groups (roles in Opti ID)

Optimizely CMS 13 has built-in user groups with pre-defined access levels shown in the following image. The Everyone and Administrators user groups exist only in CMS 13 and are evaluated during runtime. This means you cannot assign them to users and instead, the system handles that. The Content Admins and Content Editors user groups exist in CMS 13 and Opti ID. In Opti ID, these user groups are called roles, which you assign to users or groups in Opti ID to give specific users, or groups of users, this access.

Administrators – Windows defines this group when you create the application. An administrator can access every part of the system and can edit all application content. Often, administrators are developers who configure or maintain the application.

Content Admins – Optimizely defines this role to access administrator functions. Membership in this group does not provide editing access to the content structure. In most cases, only a few system administrators or "super users" belong to this group.

Content Editors – Optimizely defines this role to access the editing functions. Add users to this group who need access to the editing functions. You can then add users to groups to give them editing rights to specific content. You can organize editors in groups according to content structure or language on large applications.

Everyone – Windows defines this role as giving visitors read access to application content. Unregistered visitors to a public application are anonymous, meaning the system cannot identify them. If you want to remove the Everyone group from content (to change access rights for a web page, for example), you must log in to access content, even if it is published.

You can assign these CMS 13 built-in user groups to users and groups in Opti ID.

To assign a CMS 13 user group to an existing user in Opti ID, see View user details and edit accessView user details and edit access in the Opti ID documentation.

To assign a CMS 13 user group to an existing group in Opti ID, see Edit a groupEdit a group in the Opti ID documentation.

To add users in Opti ID, see Manage usersManage users in the Opti ID documentation.

To add groups in Opti ID, see Manage groupsManage groups in the Opti ID documentation. Groups in Opti ID let you assign the same access to a group of users at once instead of individually assigning the same access to multiple users.

To apply custom permission levels, create custom roles in Opti IDcreate custom roles in Opti ID, where you can assign the roles to users and groups. Then when a user signs into CMS 13 with a custom role, that role syncs to CMS 13 as a user group, where you define the access level (read, create, change, delete, publish, administer).

Types of access

Access types determine the scope of what each user group sees and changes in CMS 13. Administrators select the right types so editors, visitors, and audiences each receive permissions matched to their work. Control which parts of the CMS 13 application content structure are available to business users, such as content editors and site administrators, and what is available with restricted access to visitors. Visitors can also post comments on the application through access rights.

Access to features

Opti IDOpti ID provides single sign-on across all Optimizely products using an identity provider (IdP) or a local login. You also can manage your users in a centralized locationmanage your users in a centralized location. Each part of the Optimizely platform has different built-in roles and groups to control authentication and authorization. (Developers may configure permissions during implementation and service onboarding.)

Administrator access in Optimizely is required to configure access rights.

The product switcher lets you switch between products. Access individual parts of the platform directly by URL.

What you see in the CMS 13 side menu when logged in depends on which product you have selected and your permissions. The side menu is configured during CMS 13 onboarding, and access rights are defined for different user groups. See Get started with CMS 13 for details about the side menu.

Access for users and groups

Access for users and groups defines the actions an Opti ID role permits on a content item. Administrators combine these rights to match each role to a real editorial workflow. Grant or deny the following access rights in CMS 13 for Opti ID roles, which are then assigned to users or groups in Opti ID.

Read – Users with the role can access the content as a reader; otherwise, the content is invisible.

Create – Users with the role can create content under the item.

Change – Users with the role can access the content to modify it. Typically, Create and Change are set together, but in some cases you want someone to modify created content but not create content, or vice versa.

Delete – Users with the role can delete the content.

Publish – Users with the role can publish the content.

Administer – Users with the role can create and edit approval sequences and set access rights and language properties on individual content items for content given this access. This type of access does not provide access to the administrator page. To access the administrator page, be a member of the Content Admins group (see Built-in user groups (roles in Opti ID) in this article).

Access to assets and media

Access to assets and media controls who uploads, edits, or publishes shared blocks, files, and images. Administrators set rights at the folder level so editors manage only the assets relevant to their site or page. Apply access rights to assets in the content structure, including folders, blocks, and media. Define specific access rights from the Root level down, including the Recycle bin (Trash) and For All Sites (or For All Applications), which store blocks and media. Shared blocks and media share the same folder structure.

Editors must have Create access rights to the relevant global or site-specific folder under For All Sites/Applications or For This Site/Application to upload an image or create a block. When adding assets to a local For This Page folder, editors must have Create access rights to the current page instead.

To automatically publish media on upload, editors must have Publish access rights to the target folder (global, site-specific, or application-specific) or to the current page when uploading to a local folder.

📘 Note Media are never automatically published if an approval sequence is set on the folder to which the media are uploaded.

Access to languages

If your application has content in multiple languages, you can define access rights for each language so editors can create content only in the languages to which they have access. Go to Settings > Languages > select enabled language > Permissions tab to see which groups and users have access to that language. Only users with access rights to a language can create and edit content in that language. See Manage languages.

Create custom Opti ID roles and set access rights in CMS 13

Create custom roles in Opti ID to apply specific access rights to areas of your CMS 13 content tree. For example, part of your content tree may be devoted to marketing assets, and you want to limit access to only Marketing group members. In this case, create a custom role called Marketing in Opti ID, assign it to a user or group of users in Opti ID, and then assign access rights to that role after it syncs to CMS 13 as a user group.

🚧 Important You must create custom roles in Opti ID, and then define the custom role's level of access in CMS 13.

Create a custom role in the Opti ID Admin Center

Go to Roles in the Opti ID Admin Center and click Add Role. The Add Role side panel displays.

Role Name – Enter the name of the role. For example, Marketing.

Description – (Optional) Enter a description for the role. For example, Access to marketing assets in the content tree.

Product – Select Optimizely Content Management System.

Product Instances – Select one or more instances. The role is only available for use in the CMS instances you select here. For example, to make this role available across all of your CMS instances, select All instances.

Duplicate Role – Select No to create the role from scratch. To duplicate a role, select Yes, and select a role you want to duplicate, which copies the product and instances to the new role.

Select Attributes – You must define the access rights for the Opti ID role in CMS 13 after it syncs.

Click Save. The role displays in the Roles list. The following image shows the Roles list filtered by product (Optimizely Content Management System). Edit an existing role by clicking More (...) > View Custom Role or clicking the role name, then Edit.

Add a custom role to an individual user in Opti ID

Assign roles to groups instead of individuals to manage access more efficiently at scale. See Should I assign an Opti ID role to a single user or a group? in this article.

Go to Users in the Opti ID Admin Center. Search for the user and click their user name. The User panel displays information about the user.

Click Add Product Access.

Product – Select Optimizely Content Management System.

Instance – Select the desired CMS instance for which you want this user to have access.

Role – Select the custom role you created. For example, Marketing.

Select the Checkbox.

The custom role is added to the individual user's access to the selected CMS instance, as shown in the following image:

Add a custom role to a group of users in Opti ID

Go to Group Access in the Opti ID Admin Center and click Add Group.

Enter a Name for the group (for example, Marketing Members).

Select the users you want to be part of the group on the Users tab.

Specify the role (level of access) on the Products tab for a specific CMS instance that everyone in the group will have, and then click Add. For example, in the following image, users in the Marketing Members group have the Marketing role assigned to them for three CMS instances.

(Optional) Enter a group description on the Details tab.

Click Save. The group displays in the Group Access list. The following image shows a filtered Group Access list and five users in the custom group.

Verify that a user's access is assigned through a group in either of the following ways:

Select a group on the Group Access page, and then check the Users tab of the group details.

Go to the Users page, view a user's details, and expand the assignments in the Access section.

When you look at the details in the following image, Zach can access three instances through the Marketing role assigned to the Marketing Members group (see notification below each role).

Set access rights in CMS for Opti ID roles

At this point, you have created a custom role for CMS 13 in Opti ID and assigned it to a user or group of users in Opti ID. The custom role syncs from Opti ID to CMS 13 when a user signs into CMS 13 with the custom role. (Optional) Assign the role to yourself and sign in to initiate the sync.

Now that the custom Opti ID role is in CMS 13 as a user group, define access rights for it.

Go to Settings > Set Access Rights in CMS 13 and select the content tree item you want. For example, Marketing.

Scroll to the bottom of the tree to see the access rights if your content tree is large.

Clear Inherit settings from parent item to create custom access rights for the selected branch (for example, Marketing). To apply your custom settings to the subitems of the branch you selected of the content tree, select Apply setting for all subitems.

(Optional) Clear the checkboxes for existing CMS 13 user groups to remove unwanted access to this branch of the content tree.

Click Add User/Group and select the custom Opti ID role you created (for example, Marketing).

Set the CMS 13 access rights for the custom Opti ID role and click Save Access Rights.

Select the same page of the content tree (for example, Marketing) to refresh the page. The new access rights display.

Content tree subitems also display the new access rights inherited from the Marketing page.

Now the custom Opti ID role you added is in CMS 13 as a user group, and you have defined access rights for it. Any users or groups that you assign this custom role to in Opti ID now have the access you defined in CMS 13.

Remove CMS 13 access rights for an Opti ID role

To remove access for an Opti ID role, delete the role in Opti ID rather than clearing its access rights in CMS 13. Deleting the role removes it from all assigned users and groups, regardless of whether it still exists in CMS 13 with defined access rights.

Access rights inheritance and subitems

Set inheritance for content subitems

Content inherits access rights from its closest parent item by default. When you set access rights for a content item, the rights apply to it, and subitems that have the Inherit settings from the parent item option enabled. Subitems with this option cleared are not affected. For example, Addresses, Cards, Dictionaries, Mosey Bank Footer, and Mosey Bank Header have the same access rights because they inherit the access rights from the Content page.

If you break the inheritance for Cards and change its access rights, the access rights become different from the parent (Content) and its two siblings (Addresses and Dictionaries). An example of this is shown in Set access rights from the All Properties view in this article.

Set access rights for subitems

Selecting the Apply settings for all subitems checkbox applies the access rights of the parent item to its subitems, even if a subitem has inheritance cleared. The option adds settings to a subitem it did not have before and does not change or remove any existing settings. For example, you can apply the same access rights from the Content parent page to its children (Addresses, Cards, Dictionaries, Mosey Bank Footer, and Mosey Bank Header).

When you select Apply settings for all subitems, anyone with a selected CMS 13 user group is given access.

Suppose a parent item and a non-inheriting subitem have the same CMS 13 user group, and the access rights for the CMS 13 user group differ between the parent and the subitem. In that case, CMS 13 applies the parent's settings when you select Apply settings for all subitems. For example:

If the Content parent item has Opti ID role Content access with only Read access set and the Mosey Bank Header subitem has Opti ID role Content access with all access rights set, then Apply settings for all subitems on the Content parent item resets the Opti ID role Content access access rights on Mosey Bank Header to Read access only.

Conversely, suppose Content has Opti ID role Content access with all access rights, and subitems have Opti ID role Content access with only Read access. In that case, Apply settings for all subitems gives Opti ID role Content access all access rights on the subitems.

Administrators generally manage website access rights from Settings. However, you can give editors the right to manage access rights for a single page or a block from the Publish or Options menu if you have administrator rights. This is useful when you need to publish an item to verify the final result without making it publicly visible.

The following example shows how to set additional access rights to (1) the Mosey Bank item (and its subitems) and then set different access to (2) the Insights item and its subitems).

You must have CMS 13 administrator access in Opti ID to define access rights. This setting does not provide access to other administration options in CMS 13.

Select Mosey Bank in the content tree, open the Publish/Options menu, and select Access Rights.

Clear Inherit settings from parent item if an item inherits access rights from the parent page. You can now edit the access rights.

Set the access rights you want, and click Save.

Select Insights in the content tree, and open the Publish/Options menu and select Access Rights. The Authenticated Opti ID role was inherited.

Clear Inherit settings from parent item to edit the Authenticated Opti ID role's access rights.

Clear the settings for the Authenticated Opti ID role and click Save.

Go to Insights subitems (Giving Back, Financial Services..., and How to: Use AI...) and click Manage to verify that the Authenticated Opti ID role was removed from the access rights of those subitems. The Authenticated Opti ID role was given specific access to all items in Mosey Bank except for Insights and its subitems.

If you clear access for the Everyone CMS 13 user group, the page is hidden from the public but remains visible and editable for Administrators, Content Admins, Content Editors, and SearchIndexer CMS 13 user groups.

Should I assign an Opti ID role to a single user or a group?

Assign an Opti ID role to a single user or group of users, and then set access rights for everyone assigned to that role to content in the CMS 13 content tree. For example, assign a role to Abbie in Opti ID, then set the access rights for that role in CMS 13 so only Abbie (and system administrators) can edit the Book a Demo page. Add the Opti ID role assigned only to Abbie to any number of pages and content and set the role's (and therefore Abbie's) access rights to each content item similarly (or differently) for each page.

If you have several users who need common access to content, managing access rights on a user-by-user basis can be complex. Instead:

Create a custom role in the Opti ID Admin Center.

Add a custom role to a group of users in Opti ID.

Set access rights in CMS for Opti ID roles.

For example, create a custom Marketing role in Opti ID, create a Marketing users group in Opti ID, add the Marketing role to the Marketing users group in Opti ID, then add Abbie, Erin, and Reid to the Marketing users group in Opti ID. Now when you give access rights to any number of pages and content in CMS 13 for the Opti ID Marketing role, that gives everyone in the Opti ID Marketing users group the same access at once instead of having to assign it to each individual. Then you can modify the Marketing user group to add Eddie to all the marketing content (or remove Abbie).

📘 Note If you set conflicting access rights to content, selected access rights prevail over cleared access rights. For example, Abbie is a member of the Marketing users and Support users groups in Opti ID, each have Opti ID roles with different CMS 13 access rights set on the same content; Marketing has Publish rights, but Support does not. Abbie, who is in both groups, has Publish rights to the content, but Erin, who is only part of the Support group, does not have Publish rights.