ProcessWire as an Enterprise Publishing System

[wheelmaker24]

Hello there,

I've already realized many projects with ProcessWire and would love to use it for a bigger project now. Maybe you can help and allay my doubts

• Enterprise Single Sign-On?
  
  We are currently using Microsoft SharePoint (2003…) as a publishing tool for our intranet web pages. This of course is no good solution concerning responsive design, flexibility and scalability. Because we are talking of a big company (about 9000 employees) it is important to protect the ProcessWire installation with an Enterprise Single Sign On (SSO). It seems like Shibboleth is a good solution to handle the communication between the Microsoft Server from the company and the Linux Apache for the intranet web page.
  
  Has anyone already used ProcessWire in an environment like this? It would be great to use the employees IDs and hand them viewing / editing rights for single pages.
   
• Permission Management for 9k users?
  
  Of course most of the employees should only get viewing rights. But it would be great being able to give editing restrictions for specific pages. As I understand this is something ProcessWire does not support with its core features – even though there are modules for this particular case.
  
  The question is: Is it responsible to build a big system based on many modules in consideration of future upgrading, scalability and co.?

Looking forward to your comments on this

Happy coding!

wheelmaker24

[teppo]

I've already realized many projects with ProcessWire and would love to use it for a bigger project now. Maybe you can help and allay my doubts

Glad to hear you like ProcessWire, and hope to be of help here. Also: welcome to the forum!

Enterprise Single Sign-On?

We are currently using Microsoft SharePoint (2003…) as a publishing tool for our intranet web pages. This of course is no good solution concerning responsive design, flexibility and scalability. Because we are talking of a big company (about 9000 employees) it is important to protect the ProcessWire installation with an Enterprise Single Sign On (SSO). It seems like Shibboleth is a good solution to handle the communication between the Microsoft Server from the company and the Linux Apache for the intranet web page.

Has anyone already used ProcessWire in an environment like this? It would be great to use the employees IDs and hand them viewing / editing rights for single pages.

Check out this post by Tom Reno. Apparently they're using Shibboleth, and he even mentioned the idea of turning this into a configurable module. You could always drop him a note and check if he's got any plans regarding this; I'm sure there are others who'd benefit from that kind of module too

Permission Management for 9k users?

Of course most of the employees should only get viewing rights. But it would be great being able to give editing restrictions for specific pages. As I understand this is something ProcessWire does not support with its core features – even though there are modules for this particular case.

This depends a lot on how you want to manage your site. Above you mentioned per-user page-specific permissions, which is one approach you could definitely take; there are many examples of something similar floating around the forum, it's surprisingly easy to build yourself, and then there's the Page Edit Per User module by Ryan.

On the other hand, if you're interested in a solution that's slightly less "fine-grained" but easier to manage, Ryan's Dynamic Roles module is also worth checking out. I haven't used it that much myself, so won't go into detail on it's inner workings; from what I can tell, it's used on many large-scale sites already.

We've been using the UserGroups module for all of our "per-page view/edit" needs, and we're quite happy with it; might be partly because we've been heavily involved in the creation of this module, of course. UserGroups adds a new concept of "user groups", and lets you assign view or edit permissions for each given page to one or more of these groups, which in turn can contain any number of users. Permissions are inherited, so you don't have to specify permissions for each page individually.

The question is: Is it responsible to build a big system based on many modules in consideration of future upgrading, scalability and co.?

Wanted to answer this part separately, since the answer (to me) is quite obvious: absolutely not!

On the other hand, a few modules here and there are not a problem, and most of the modules you'll find in the Modules Directory are of great quality. While you can't (and shouldn't, even if you could) build a ProcessWire site just by using installing a bunch of modules, you should feel safe to make use of those that do fit your needs.

We're not like [insert the name of a very popular blogging platform here], and the answer to every need isn't "there's a plugin for that". With ProcessWire you'll most likely be doing much more hand-crafting, but for many popular needs there's also a handy module – and if there isn't, just ask and often you'll be surprised at how fast the community can answer with a full-fledged solution.

[Pete]

Just thought I'd add that there's an LDAP login module (on mobile so can't find the link right now) that I've been using just fine for authentication with Windows 2008 and 2012 servers from an external Apache server with no issues whatsoever (well unless one can't talk to the other due to network issues but you could sunc your username and password with PWs users every login and just let PW handle the login if it can't see the LDAP server for whatever reason).

[teppo]

Thanks for the clarification, Pete. I was pretty sure that there's something like this, but wasn't sure at what state it was. Seems that there are a couple of solutions to this, in fact, and this one by Conclurer seems like the best choice at the moment 

... well unless one can't talk to the other due to network issues ...

This, I'd say, would in most (especially "enterprise" scale) cases be intentional.

If you can't validate current user via the master server for whatever reason, you can't know for sure if the user still has a valid account.. and thus you definitely shouldn't let her in. Sure, stable connection is a necessity, but this is also the only way to be sure

[Pete]

That's a good point and I remember now that was the reason I didn't try to fix what wasn't an issue

[wheelmaker24]

Wow, thanks a lot for your responses so far! I've dropped Tom Reno a note as I think the Shibboleth integration would work quite smooth (concerning auto login capabilities and so on). Although I will definitely have a look at the LDAP module.

I pretty much like the idea being able to build nearly everything with the core features of ProcessWire.

On last question: We might be able to integrate the company's social features (there is a Facebook like application which can be partially included). But actually they are not very quick in adapting it to different environments and have performance problems. So I'm thinking about using the ProcessWire comment module by Ryan instead. This of course would make the Shibboleth integration necessary. Is there anything like a "like module" as well? We would love to use it for the news posts on our starting page.

So far the ProcessWire community seems to be the most active community I've met! I pretty much appreciate your efforts and would love to contribute in anyway

[Pete]

There sure is - one of Ryan's commercial modules: https://processwire.com/talk/store/product/11-likes-fieldtype-single/

[wheelmaker24]

Hi again, in this case we would need a user-based counter. I just realized that I therefore only need to create

a page reference field named "likes" that refers to the user pages (multi-select, not editable via the editor). Great!