User manual MACROMEDIA CONTRIBUTE 3 - DEPLOYING CONTRIBUTE

CONTRIBUTE 3 Deploying Contribute Trademarks Add Life to the Web, Afterburner, Aftershock, Andromedia, Allaire, Animation PowerPack, Aria, Attain, Authorware, Authorware Star, Backstage, Bright Tiger, Clustercats, ColdFusion, Contribute, Design In Motion, Director, Dream Templates, Dreamweaver, Drumbeat 2000, EDJE, EJIPT, Extreme 3D, Fireworks, Flash, Flash Lite, Flex, Fontographer, FreeHand, Generator, HomeSite, JFusion, JRun, Kawa, Know Your Site, Knowledge Objects, Knowledge Stream, Knowledge Track, LikeMinds, Lingo, Live Effects, MacRecorder Logo and Design, Macromedia, Macromedia Action!, Macromedia Breeze, Macromedia Flash, Macromedia M Logo and Design, Macromedia Spectra, Macromedia xRes Logo and Design, MacroModel, Made with Macromedia, Made with Macromedia Logo and Design, MAGIC Logo and Design, Mediamaker, Movie Critic, Open Sesame!, Roundtrip, Roundtrip HTML, Shockwave, Sitespring, SoundEdit, Titlemaker, UltraDev, Web Design 101, what the web can be, and Xtra are either registered trademarks or trademarks of Macromedia, Inc. and may be registered in the United States or in other jurisdictions including internationally. Other product names, logos, designs, titles, words, or phrases mentioned within this publication may be trademarks, service marks, or trade names of Macromedia, Inc. or other entities and may be registered in certain jurisdictions including internationally. Third-Party Information This guide contains links to third-party websites that are not under the control of Macromedia, and Macromedia is not responsible for the content on any linked site. If you access a third-party website mentioned in this guide, then you do so at your own risk. Macromedia provides these links only as a convenience, and the inclusion of the link does not imply that Macromedia endorses or accepts any responsibility for the content on those third-party sites. Apple Disclaimer APPLE COMPUTER, INC. MAKES NO WARRANTIES, EITHER EXPRESS OR IMPLIED, REGARDING THE ENCLOSED COMPUTER SOFTWARE PACKAGE, ITS MERCHANTABILITY OR ITS FITNESS FOR ANY PARTICULAR PURPOSE. THE EXCLUSION OF IMPLIED WARRANTIES IS NOT PERMITTED BY SOME STATES. THE ABOVE EXCLUSION MAY NOT APPLY TO YOU. THIS WARRANTY PROVIDES YOU WITH SPECIFIC LEGAL RIGHTS. THERE MAY BE OTHER RIGHTS THAT YOU MAY HAVE WHICH VARY FROM STATE TO STATE. Copyright © 2002-2004 Macromedia, Inc. All rights reserved. This manual may not be copied, photocopied, reproduced, translated, or converted to any electronic or machine-readable form in whole or in part without prior written approval of Macromedia, Inc. Acknowledgments Project Management: Jennifer Rowe Writing: Chris Bedford, Jennifer Rowe Managing Editor: Rosana Francescato Editing: Mary Kraemer, Barbara Milligan, Lisa Stanziano, Anne Szabla Production Management: Patrice O'Neill Media Design and Production: Adam Barnett, Christopher Basmajian, Aaron Begley, John Francis Special thanks to Ken Sundermeyer, Eric Lerner, Chris Denend, Joel Huff, Lawson Hancock, Erik Larson, Sheila McGinn, Emilio Passi, Yoko Bayer, Scott Richards, Melissa Baerwald, Deb Galdes, Kimberly Oslob, Dennis Griffin, Jon Varese, Brady Kroupa, Josh Margulis, Gavin Anderson, Deeje Cooley, Vickie Chapman, Kaori McLister, and the Contribute engineering and QA teams. First Edition: July 2004 Macromedia, Inc. 600 Townsend St. San Francisco, CA 94103 CONTENTS Deploying Contribute to Departments and Enterprises ....................... 5 Contribute deployment responsibilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Deployment tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Deployment issues. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 User management models . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Contribute user roles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Contribute and website security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Website connection distribution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Deploying Contribute across an organization . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Approvals and site structure. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Content design considerations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Contribute Publishing Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Contribute case studies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 3 4 Contents Deploying Contribute to Departments and Enterprises Macromedia Contribute is a website editor that lets people connect to departmental and other websites so that they can update web page content. Administrative assistants, product managers, human resource managers, and other people in an organization can use Contribute to update their workgroup's web pages without having to contact a web team or other departmental resources. The following examples show how Contribute might be used in an organization: · · · · · Updating schedules Posting job requisitions Updating an employer's work-related policies and guidelines Editing organizational charts Sharing information among team members through a departmental intranet This chapter, which is intended for website administrators and IT professionals, describes the best practices for deploying Contribute within an organization. It explains how to set up Contribute in a variety of IT environments so that content editors and website administrators can enjoy the power and flexibility of this application. This chapter contains the following sections: "Contribute deployment responsibilities" on page 6 "Deployment tasks" on page 7 "Deployment issues" on page 8 "User management models" on page 16 "Contribute user roles" on page 17 "Contribute and website security" on page 18 "Content design considerations" on page 24 "Contribute Publishing Services" on page 29 "Contribute case studies" on page 29 5 Contribute deployment responsibilities As a system or website administrator, you play a large part in deploying Contribute. The deployment responsibilities include the following tasks: · Installing the Contribute software. · Creating connections to websites that users of Contribute (called content editors) access. · Defining roles (a collection of privileges that you assign to a specific user or group of users). Roles determine which users have, or are denied, access to a specific website. · Installing Contribute on individual computers throughout your organization. · (Optional) Integrating Contribute with Contribute Publishing Services. The size of your organization and the job roles associated with your organization's websites determine who assumes responsibility for deployment. A single system administrator may be responsible for all deployment, or other members of the organization's web team or IT staff may be involved. Administrators manage Contribute websites by controlling who has access to the site and by specifying what kinds of changes content editors can make to a website. Administrators, web masters, and web designers If you are a system administrator, this might be your first time to work with web pages and web content. Your role as a system administrator may intersect with the role of web designer. A web designer can help you determine the editing and access requirements of your site and help you construct the site so that users with limited web-design skills can easily update content. Contribute gives you a great deal of power and flexibility in determining who can edit web pages on a website and what types of changes they can make. For example, you might decide that all Contribute users, with the exception of the web-design staff, are limited to editing text on web pages, and that the web-design staff can edit text, apply new text styles (for example, change the type font), and insert new images. Contribute job functions The following table describes the function of each role that relates to Contribute: Role Function Contribute administrator Responsible for installing Contribute, setting up user roles and privileges, and determining the degree to which users can access and update websites. Contribute administrators are often members of an organization's IT staff, responsible for maintaining server and network infrastructure, managing user and file permissions across an organization's network. System administrator Maintains web servers and web server access. This role often overlaps with that of the Contribute administrator and may be handled by the same person in smaller organizations. Designs websites, determining their look and feel, and creates and maintains the site's content. Web designer 6 Deploying Contribute to Departments and Enterprises Role Web developer Contribute user Function Develops web-based applications, such as for absence reporting and financial reporting, distributed to users over the web. Contribute users range widely in their job tasks and computer experience. What they have is common is the need to update web page content quickly and easily. Using Contribute, they can easily connect to a website and safely update its content without inadvertently introducing malfunctions. These roles vary from organization to organization. In smaller organizations and workgroups, a single person may handle the job of administering Contribute and determining the design of the website. Larger workgroups and departments may have a team of people involved in maintaining their website. Deployment tasks The following table describes the tasks you need to perform to successfully deploy Contribute. Task Gather website information Configure network and server permissions Description Gather information about your website's infrastructure. You'll need this information to properly install and configure Contribute. For more information, see "Information about your website" on page 8. Ensure that the network and server permissions allow read, write, and modify access so that Contribute users can connect to the site and update pages. For more information, see "Understanding network and server permissions" on page 9. Install Contribute on the computer from which you'll administer the site, create a connection to the website using Contribute, and establish yourself as the Contribute administrator for the site. To learn more about creating an administrative connection, see "Contribute administrative connections" on page 9. Contribute Publishing Services (CPS) is a suite of Java server applications that lets you integrate Contribute with Lightweight Directory Access Protocol (LDAP) or Active Directory services, and implement email notifications to keep Contribute users informed about the status of their drafts in progress. If you want to use the CPS, you must install and configure the Publishing Service server on a Java application server. For more information, see "Contribute Publishing Services" on page 29. After you establish yourself as an administrator of a site, you can configure the administrative settings so that Contribute works more efficiently with your website. For more information, see "About Contribute administrative settings" on page 10. Install Contribute Install Contribute Publishing Services (optional) Configure Contribute to work with your website Deployment tasks 7 Task Create Contribute roles Description Create Contribute roles based on the privileges and restrictions you want to place on a user's ability to access and edit pages within the site. For more information, see "Contribute user roles" on page 17. Deploy Contribute to your users, and send them connection key files so they can access the website. To learn more about distributing website connections, see "Website connection distribution" on page 21. Deploy Contribute to your user base In addition to the basic tasks described in the preceding table, you might want to further enhance your website by designing it to be more easily maintainable or by adding additional functionality by using CPS. Deployment issues The following sections describe issues you should be aware of when deploying Contribute in your organization. As with all client software that provides access to centralized servers on a network, Contribute requires that certain network and server file permissions be appropriately configured for users. Before installing Contribute and deploying it to users, ensure that you have considered the following issues and have appropriately configured your website environment for use with Contribute. This section contains the following topics: "Understanding network and server permissions" on page 9 "Contribute administrative connections" on page 9 "About Contribute administrative settings" on page 10 "Contribute site structure" on page 11 "Network paths and web addresses (URLs)" on page 11 "Contribute network connection types" on page 12 Information about your website Before you install Contribute, you must gather information about your organization's website infrastructure. You need to find the answers to the following questions: · · · · · Where is the server on the network? Who can access the server? Do new users and permissions need to be created on the server? What type of network connection will you use to connect to the website? If you are using File Transfer Protocol (FTP) or Secure FTP (SFTP) to connect to the website, what FTP software is being used? · What web server software is in use, and where is the website's root folder? · What is the URL of the website? 8 Deploying Contribute to Departments and Enterprises Although these questions may seem obvious, it's good to think about them before you create a connection to your website with Contribute. The sections below will help to provide you with background information on these questions, and how they relate to installing and configuring Contribute. Understanding network and server permissions Contribute is unique in that it allows editing of web pages directly on the server hosting your website. This level of server access makes network permissions and access control especially important. There are at least three levels of permissions for every Contribute site: the permissions defined by the network operating system (for instance, Windows or UNIX server software), the permissions defined by the web server software, and the roles you define within Contribute. Network permissions can be set in several ways through a variety of systems. Contribute always adheres to the network permissions for read and write access to folders. It also obeys permissions set through LDAP and similar systems. Contribute can never overwrite any server- or networklevel permissions. Note: The server's network and operating system permissions, and the web server software's permissions, always take precedence over Contribute permissions. Whenever you provide access to a web server, you should take precautions to ensure that the operating system of the server hosting the site, as well as the web server software itself (and the FTP server, if you are using FTP), are secure. For the best practices related to securing your website from accidental and malicious tampering, see the documentation provided with your server's operating system, FTP, and web server software. Note: You can set folder permissions to allow a user or group of users to modify a folder and later define more restrictive folder- or file-editing options when you define the Contribute user roles. Related topics: · "Contribute user roles" on page 17 · "Contribute and website security" on page 18 Contribute administrative connections After you gather information about your website infrastructure and configure the network and server permissions for appropriate read, write, and modify permissions, you must install a copy of Contribute and create a Contribute administrator connection to the website. As an administrator, you are responsible for configuring Contribute administrative settings, identifying users, defining user roles, installing Contribute on each user's computer, and distributing connection information so that users can connect to the website. When you set up the Contribute administrator user role, consider whether you will be the only administrator of the website. If more than one person will be administering the site, you may need to create a group e-mail account that notifies all administrators when a user encounters a problem. To learn more about creating a connection, see "Creating and Managing Website Connections" in Macromedia Contribute Help. Deployment issues 9 About Contribute administrative settings Contribute administrative settings are a collection of settings that apply to all users of your website. These settings let you fine-tune Contribute to provide a better user experience. The Contribute administrative settings are as follows: Users and Roles lets you add users to the site, and create, edit, and delete roles. Administration lets you specify a primary administrator for the site, set an administrator password, and remove administration. Tip: Contribute does not require that you set an administrator password; however, you should create a password to protect access to the administrative functions. If you fail to assign an administrator or an administrative password, anyone with a Contribute connection to the site can make themselves an administrator of that site. Publishing Services lets you enable CPS. Publishing Services is a suite of applications running on their own server that let you extend the capabilities of Contribute as well as providing additional functionary for users of Contribute. Note: If you will be using the Publishing Services User Directory service, you should enable Publishing Services and the User Directory service before adding users to the site. When you start the User Directory service, any users who have connected to the site are removed, and any connection keys you might have sent to users become disabled. To learn more about Publishing Services, see "User management models" on page 16 and "Contribute Publishing Services" on page 29. Web Server lets you configure Contribute to work with your website's specific web server configuration. Because all websites vary somewhat in how they are set up, the configuration options in the Web Server dialog box let you specify settings specific to your website, which Contribute might not be able to determine automatically. To learn more about the web server configuration settings you can specify, see "Web server index pages" and "Alternate website addresses" in Macromedia Contribute Help. Rollbacks lets you enable rollback files and specify the number of rollback files to maintain on the server. To learn more about rollbacks, see "Enabling and disabling rollbacks" in Macromedia Contribute Help. New pages lets you specify the encoding used for characters in web pages and the default page extension (.htm, .html, and so on) to use when creating new pages. By default, the character encoding for new pages is set to Western, which applies to all English and Western European languages. The default encoding is set from your computer operating system's default encoding. Additional options include Central European, Cyrillic, Greek, Icelandic, Japanese, Traditional Chinese, Simplified Chinese, and Korean. If you want to create pages that display characters for multiple languages, select UTF-8. To learn more about preference settings for new pages, see "Specifying new page preferences" in Macromedia Contribute Help. 10 Deploying Contribute to Departments and Enterprises Related topics · "Configuring Contribute administration settings" in Macromedia Contribute Help Contribute site structure The connection you create to a website with Contribute determines the network protocol to use when accessing the site, the web address (URL) of the site, and the degree to which the site's structure is accessible to content contributors. Before creating a connection to a website, carefully consider how users will access the site and what areas of the site they will need to access. Network paths and web addresses (URLs) When creating a connection to the website, Contribute prompts you to provide the web address (URL) of the website, and the network connection information of the server and folder storing the website. Both the web address and network path must point to the same folder in the website. For example, suppose your website is located at the directory path \\MyServer\wwwroot\sites\MySite, and the corresponding web address for this site is www.MyServer.com/sites/MySite. When creating the connection, you must enter these values correctly, so they point to the same folder. To ensure that the website and network folder (or in the case of FTP and SFTP, the FTP folder) are the same, Contribute uploads a temporary file using the path information you provide. Contribute then attempts to read the temporary file through HTTP, using the web address you provide. If Contribute succeeds in locating the temporary file, the paths match, and Contribute creates the connection. If the paths don't match, Contribute prompts you again for the correct path. Note: If your users will use FTP to connect to a website folder beneath the FTP Host folder, you must provide an absolute path to the folder. Contribute connection paths As the administrator, you can establish a connection to the root folder in a website if you need access to all the folders in that site. Alternatively, you can establish a connection to a higher-level folder, depending on the access you and your users require. The root of a Contribute site is defined when you create an administrative connection and select the website folder to connect to. All folders from the root website directory and below are within the Contribute site. Typically, you create a connection at the root of your website, and use the Contribute Permissions settings to limit user access to specific folders in the site. Contribute does not let you create overlapped (or nested) connection paths. For this reason, you should create a connection to the highest required access level in the site structure. If you need to limit users to folders below this level, you can use Contribute Permissions settings to specify folder access and editing options. For information about roles, see "Contribute user roles" on page 17. Deployment issues 11 The following example shows overlapped connection paths: connection1: www.mysite.com/intranet/ connection2: www.mysite.com/intranet/marketing In the following example, the paths do not overlap: connection1: www.mysite.com/intranet/marketing connection2: www.mysite.com/intranet/finance Contribute administrative files and folders Contribute creates a special administrative folder (labeled _mm) that contains a shared settings file in each website you create a connection to. The shared settings file contains information about each role you define, including the administrator role and any site-wide settings you define. Storing this information on the server lets you make changes to Contribute role and site-wide settings, without having to resend connections to users. The changes are automatically applied when the user connects to the site. If you are creating multiple site connections for various sets of users, make sure that the connection paths you define do not overlap (see "Network paths and web addresses (URLs)" on page 11). As the administrator, you should create your connection at the highest level of access pertinent to the website; you can define roles to allow users access at lower levels of the site, depending on their specific access requirements. To learn how to secure the administrative folder and the shared settings file it contains, see "Restricting access to administrative folders" on page 19. Related topics · "Approvals and site structure" on page 22 Contribute network connection types Contribute lets you connect to websites using one of several network connection types. The connection type you choose depends upon the infrastructure of your website. For example, if you are deploying Contribute to update a workgroup's intranet site, you can, in most instances, use a local area network connection. However, if the site is hosted through an ISP or other external resource, you might need to use either an FTP, SFTP, or WebDAV connection. The following sections discuss the Contribute configuration issues you must consider for various network connection types: · · · · "Local area networks" on page 13 "File transfer protocol (FTP)" on page 13 "Secure FTP" on page 14 "WebDAV" on page 15 12 Deploying Contribute to Departments and Enterprises Local area networks When Contribute is used to connect to a web server through a local network, the web server must be visible to the local network. Contribute can also be used with virtual private network (VPN) servers to ensure that all file transmissions occur behind your firewall. If the web server is not visible to the local network, you can create an FTP connection with Contribute to work with the website (if the server you're creating a connection to has an FTP server installed). To ensure that you are entering the correct network path, use the Browse button of the Connection wizard to locate and select the network folder. If the path to the folder is correct, but Contribute still cannot create a connection, verify that the folder has proper read/write permissions. Tip: Depending on how the server you are connecting to is configured, you might not be able to see the complete path to the website folder. If you cannot connect to the server, make certain you are using a fully qualified path. To learn how to check your server's network and folder permissions, see the documentation supplied with your server operating system. File transfer protocol (FTP) Tip: If you will be using FTP to connect to a website, Macromedia recommends using SFTP. In addition to providing a secure connection when transferring files to and from Contribute and your website, SFTP is a more reliable connection protocol. To learn more about SFTP, and the benefits it provides, see "Secure FTP" on page 14. If users will be accessing the website using FTP, ensure that the folder has delete, overwrite, and rename privileges enabled. When anonymous FTP is used, these options are typically disabled by default so that users cannot update pages or add new pages to the website. When you create an FTP connection, Contribute attempts to auto-detect the FTP path, checking that the FTP folder is the same folder that contains your website files. If the folder paths don't match, Contribute can't write to the page displayed by your browser and prompts you to enter the correct path. To ensure that you are entering the correct FTP path, use the Browse button of the Connection wizard to locate and select the FTP folder. If the path to the folder is correct but Contribute still can't create a connection, verify that the folder has proper read, write, and modify permissions for the user. If you are creating an anonymous FTP account, the server must be configured to support delete, rename, and overwrite permissions for the anonymous user. In some cases, file permissions on UNIX servers may be configured in a way that prevents Contribute from operating, especially if the server doubles as a file server. For more information, see "Setting up a site connection in Contribute" on the Macromedia Contribute Support Center. To test whether FTP is set up correctly for an end user, you can transfer a test web page to the server. Then, using the login settings you provide to the user, attempt to view the page in a browser. Deployment issues 13 Secure FTP SFTP is a secure version of the FTP protocol. Like SSH, SFTP prevents unauthorized users from gaining access to password and user information that is sent without encryption over the Internet. Standard FTP sends the user ID and password as clear (that is, unencrypted) text, allowing anyone monitoring your FTP data to see your user ID and password, as well the data being transmitted. With SFTP, everything you transmit is encrypted, protecting it from monitoring by intruders. In addition to increased security, Macromedia recommends using SFTP because it's a more robust protocol that provides more reliable performance. The following reasons describe why SFTP is a better protocol: · · · · · A more strict protocol than FTP Supports functionality that FTP does not Is more efficient than FTP Does not conflict with firewalls, proxy servers, or routers Provides a secure connection over which to transfer files To use SFTP with Contribute, you must have an SFTP server installed. You cannot use a standard FTP server and simply select SFTP from the connection type choice within Contribute; the connection will fail. You must also have Secure Shell 2 (SSH2) enabled on the server. Contribute provides SFTP only over SSH2-protected network connections. To learn more about SFTP, see the documentation supplied with your server's operating system and SFTP server. To learn more about SSH2, see the SSH Communications Security website at www.ssh.com. Note: Contribute supports only password-based authentication. Other authentication methods, such as certificate-based authentication, public key, and Kerberos, are not supported. FTP and SFTP file permissions Typically, FTP servers are configured so that when they create (or write) a new file, the permissions created for the file give the person uploading the file read/write permission and give members within the permission group read-only access. In the case of Contribute, this process can cause a problem when another user tries to edit a page. Contribute can read the file, but when it attempts to copy the updated file back to the web server, the FTP server's file permissions prevent Contribute from writing the new file. When configuring your FTP server to work with Contribute, be certain to configure the file permissions that the FTP server creates for new files so that members of the permission group can read and write the file. This issue typically occurs on UNIX servers. You should set the permissions for files to umask 664, which provides read and write access to the file owner (the person who created the file) and to the permissions group (which would include any users needing to connect to the website to update the file). 14 Deploying Contribute to Departments and Enterprises WebDAV Web-based Distributed Authoring and Versioning (WebDAV) is a series of extensions to the HTTP protocol that lets users collaboratively update and manage files on a website. A key feature of the WebDAV protocol is file locking. Users connecting to a WebDAV-enabled site lock files when they open the file for editing. This prevents a user of the same website from overwriting another user's changes. To use Contribute with a WebDAV-enabled site, you must use a WebDAV server that supports exclusive write locks. Exclusive write locks guarantee that only the lock owner (the person who opened the file for editing) can overwrite the file. Note: Some WebDAV servers support shared write locks, which allow two or more users to collaborate concurrently on a web page. Contribute does not support shared write locks. If a user opens a page using Contribute on a WebDAV-enabled site that uses shared locks, Contribute opens the file only if it can create an exclusive lock. If another user is editing the file, Contribute informs the user that the file is not available for editing. When creating a connection to a WebDAV-enabled site, you must provide a WebDAV-specific URL. This might consist of a specific port number used by the WebDAV site. For example, suppose that this is the URL of your site: www.mysite.com/ This might be the WebDAV URL: www.mysite:81.com/ Appending the port number 81 to the site's domain name specifies the network address used by WebDAV. WebDAV-enabled sites often have their own user name and password requirements. You can create these on an individual basis, or you can create a group user name and password. When creating a connection to a WebDAV site, you must not mix connection types (such as FTP with WebDAV or local area network with WebDAV). You must use only the WebDAV connection type. When you create a connection to a website using local area network, FTP, or SFTP connections, Contribute uses its own file-locking mechanism to prevent users from overwriting each other's files. Contribute connections using these connection types cannot detect files locked with WebDAV locks and could inadvertently open a file being edited by a WebDAVenabled connection. To prevent users from setting up different connection types to a WebDAV-enabled site, do one of the following: · Tell users creating connections that they should use only the WebDAV connection type with WebDAV-enabled sites. · Send a connection key that allows only users connecting to the site to use WebDAV. · Restrict local area network, FTP, and SFTP access to the server hosting the WebDAV-enabled site. For more information on WebDAV, see the WebDav Resources website at www.webdav.org. Deployment issues 15 Contribute and directory services Microsoft Active Directory and LDAP are protocols for accessing information directories. In the case of directory services, a directory is like a phone book and not like a directory (folder) on your computer. When connecting to an LDAP or Active Directory server, Contribute adheres to any file/folder permissions set by the directory service. Contribute permissions are stored in an XML file, at the root of your website, that contains specific controls for the Contribute editing environment. These Contribute permissions are layered on top of the directory service or the network/server permissions and are applied globally. They are not assigned on a per-user basis; they are simply groups of settings that Contribute reads when first connecting to a website. Contribute then conforms to these settings during the editing process. Contribute administrators can specify access to certain folders for different user groups. In addition to working within the permissions set by your Active Directory or LDAP services, you can integrate Contribute with your directory services by using the User Directory component of Contribute Publishing Services (CPS). The User Directory is an application server you install that lets you centrally manage users. To learn more about Contribute user management models, and integrating Contribute with your organization's directory services, see "User management models" on page 16. User management models User management lets you add and remove user access to websites and create user roles that restrict editing privileges within a site. User management also provides a mechanism that lets users easily connect to a website. Contribute has two user management models, manual site connections, and sites managed using the Publishing Services User Directory service. Manual connections let you communicate connection information to users, who then create their own connections, either by entering connection information in the Connection Wizard or by importing a connection key file that you give them. This user model works best for smaller workgroups and organizations. It allows you to quickly set up Contribute, create a connection to your website, define the necessary user roles, generate connection information for the website connection/user role, and send it to users in the form of a connection key file. Contribute Publishing Services lets you integrate Contribute with your organization's LDAP or Active Directory services, giving you the ability to add and remove user access to a website and modify user roles without having to resend connection key files to users. You can also create a filebased database, using an XML file to manually enter user names and passwords. CPS is intended for larger organizations that have several Contribute users to manage. Publishing Services lets you add and remove users from websites and roles without having to resend connection information. When you create a connection to a website that uses Publishing Services, you simply add users to a list that grants access to a given website and user role. When the user access the website, the Publishing Services server prompts them for a user name and password. After entering their user name and password, they are granted access to the website and the role you've assigned to them. 16 Deploying Contribute to Departments and Enterprises To use Publishing Services, you must have a J2EE application server such as Macromedia JRun installed. To learn more about Contribute Publishing Services, including how to install and configure a Publishing Services server, see the Contribute Publishing Services website at www.macromedia.com/go/cps. Related topics: · "Contribute user roles" on page 17 · "Website connection distribution" on page 21 · "Contribute Publishing Services" on page 29 Contribute user roles Contribute lets you control access to your website by creating roles. Roles are collections of settings that you create, each of which may be assigned privileges by the administrator of the site. The roles you create reflect different levels of access to page creation, editing and deletion of content, page design, and approval. You can define any number of Contribute roles and specify various options for each role you create. Contribute roles are not based on system or network user groups. You can create the same role for members of various workgroups and send them a connection. As long as the recipients have appropriate access to the network and server, they can edit the website. Default roles Contribute has three default roles: Administrator, Publisher, and Writer Administrator identifies the administrator of the site, who can create new roles and modify existing ones, add users to the site, and send connections to new users so that they can access the site. A site can have more than one person assigned to the administrative role. identifies users who can create and edit pages as well as publish pages to the website. Publisher Writer identifies users who can create and edit pages, but cannot publish pages to the website. A user in the Writer role must send their pages for review to a user in a Publisher or Administrator role who can publish the page to the site or send it back to the Writer for additional editing. Depending on your website publishing needs, and the number of people adding content to your site, you might only need to use the Administrator and Publisher roles. If you deploy Contribute in an organization where website content must be approved before it's published, you should use the Administrator, Publisher, and Writer roles. In general, you shouldn't need to create too many roles for a website. If you are deploying Contribute in a large organization that uses many internal websites to communicate information, consider creating connections to Contribute from the individual websites and sending appropriate roles to the users who are responsible for each site's content. Contribute user roles 17 Example role assignments As an example of roles you might create, consider an online magazine. The job functions associated with producing a magazine include a publisher, managing editor, copy editor, writer, and web designer. In addition, Contribute adds an administrator to maintain the magazine's website. Each role reflects separate access to article creation, approval, editing and deletion, page design, and site maintenance. The following table describes the roles and privileges related to Contribute. Job Title System administrator Contribute Role Privileges Administrator Installs Contribute, creates connections to the website, and defines Contribute roles appropriate to the magazine's job functions. The system administrator consults the designer on how to set up role settings so that other members of the magazine's staff have appropriate editing privileges within their area. Gives final approval to all articles on the website and can publish final drafts of pages or send them back for additional editing or writing. Monitors drafts as they go from writers to copy editors and keeps track of who is working on what article. The managing editor approves articles before sending them to the publisher for final approval and publication to the website. Can edit any unlocked text on a page. The copy editor cannot publish pages to the site; they send the edited articles to the managing editor for approval. Can edit any unlocked text on a page, insert images, and apply pre-defined styles to text. The designer creates new CSS styles and web page templates to accommodate changing site designs, inserts images and Flash content into pages, and adds assets to the shared asset library for writers to insert into pages. Publisher Publish Managing editor Publish Copy editor Writer Writer Web designer Writer Administrator To learn more about creating roles, and the settings that you can use to define a role, see "Managing Users and Roles" in Macromedia Contribute Help. Contribute and website security As an administrator, one of your primary concerns is in maintaining the integrity of your IT infrastructure. Contribute works within the security parameters of your network and server operating systems, ensuring that those system's safeguards take precedence over any access rights granted within Contribute. This section documents security issues that are specific to Contribute. For best practices on securing your website, see to the documentation provided with both your server's operating system and web server software. 18 Deploying Contribute to Departments and Enterprises Related topics: · "Understanding network and server permissions" on page 9 · "Secure FTP" on page 14 · "Contribute user roles" on page 17 Web page rollbacks Rollbacks let you revert to a previous version of any published web page, providing you with a level of file recovery. You do not have to roll back to the last published version; you can select any version that Contribute has saved as a rollback file. When you roll back to a previous version of a page, Contribute reverts to the previous text contained in the version of the page you select. However, any assets imported into the page may or may not be recovered. For example, suppose you update an image file outside of Contribute and then replace the original image with another image using the same filename. In this case, Contribute cannot roll back to the previous version of the image because Contribute does not manage assets outside the web pages it creates. Contribute does maintain the older version of an image if you use Contribute to edit the image in an external application. Contribute considers images, Microsoft Word documents, and other content that you edit in an external application as assets. You can roll back assets that you've edited through Contribute the same way that you roll back pages. For example, suppose you roll back from version C of a page to version A, and you used Contribute to edit an image in version B. When you roll back to version A, you will not see the current version of the image. You need to also roll back the image, independently of the page rollback. To learn more about rollbacks, see "Enabling and disabling rollbacks" in Macromedia Contribute Help. Restricting access to administrative folders When you create a site connection, Contribute creates special files that are stored in folders whose names begin with an underscore (such as _mm, _baks, and _notes). These folders may contain files with user names, e-mail addresses, previous versions of web pages, and other types of meta information used by Contribute. The underscore allows Macromedia Dreamweaver and Contribute to distinguish between those folders and the other folders in your site. Contribute and Dreamweaver use this naming convention to filter these special files and prevent them from appearing in the Dreamweaver Site panel and in the Contribute Remote File Browser. These hidden folders can't be browsed, overwritten, or inadvertently altered by users. Additionally, some search engines and automated programs are designed not to return pages found in folders whose names begin with an underscore. To ensure that these folders and files remain protected, review the configuration of your web server software and make certain that you block HTTP access to folders whose names begin with an underscore ( _mm, _baks, and _notes), the MMWIP folder, and files identified by the file extensions .lck, .mno, .bak, .lbi, .csi, and .dwt. Contribute and website security 19 In particular, you might want to block HTTP access to the MMWIP folder. The MMWIP folder contains interim drafts of files (works in progress) that you might want to protect. Macromedia recommends that you restrict access to the MMWIP folder so that only members of your organization can browse files within that folder. Note: In addition to using the computer's operating system and web server software configuration settings, you might consider using a third-party URL scanner to block HTTP access to secure these files and folders. Related topics · "Contribute site structure" on page 11 · "Staging servers and Contribute" on page 21 · "Approvals and site structure" on page 22 Apache web servers If your website uses Apache, you can explicitly disable browsing folders and files that begin with an underscore. If you know how to modify the Apache web server's httpd.conf file and have permission to do so, you can use the DirectoryMatch directive to prevent visitors from viewing any file in a folder beginning with an underscore. If you're not sure how to edit the Apache httpd.conf file or don't have permission to do so, ask your system administrator or Internet service provider (ISP) to do it for you. To learn more about limiting access to files and folders, and other security issues relevant to the Apache web server, see the documentation supplied with your Apache distribution. Microsoft IIS web servers To prevent unauthorized users from accessing Contribute administrative folders under Microsoft IIS, use access control lists (ACLs) to prevent read access by unauthenticated users of the operating system as well as by clients connecting to IIS. When you use ACLs to restrict access, only properly authenticated users can view the contents of the Contribute administrative folder. Anonymous web clients, or other users with access to the server, cannot view the administrative folder and its contents. Note: When setting permissions for Contribute administrative folders, ensure that Contribute has read/write access to the administrative folders and the files they contain. Contribute uses the settings in these files to enforce role settings of users connecting to the site. In addition to securing the administrative folders using the operating system's permissions and access control lists, you should consider using UrlScan to further secure IIS web servers. UrlScan is a security tool provided by Microsoft that screens incoming requests to the server by filtering the requests based on rules that you create. Filtering requests helps secure the server by ensuring that only valid requests are processed. To learn more about the UrlScan utility, see the Microsoft website at www.microsoft.com. 20 Deploying Contribute to Departments and Enterprises