1

I have a web portal that contains a super admin (who can edit/delete everything in the portal) and user groups who can edit/delete things that belong to their group such as a blog post.

If the super admin deletes the user group while a user is currently logged into a session in the web portal...

  • What kind of error should the user expect to see?
  • When would it appear (in refresh? or immediately after the deletion of the group?)

Similar situation:

If the super admin removes permission for a user to edit a blog post while the user is logged into the portal and is in the edit-mode.

  • What kind of error should the user expect to see?
  • When would it appear (in refresh? or immediately after the deletion of the group?)
Improve this question

2 Answers 2

Reset to default
1

The site should respond according to the authorizations set by the super user.

This means that the deleted user should subsequently get "not authorized" responses from any links (s)he clicks that require the authorization that was just deleted.

This should happen immediately and should not be dependent on a session time out or (re-)login.

Of course any user whose authorizations have been revoked, by intent or accident, is not going to be happy. There is no way to improve that. However, you can soften the blow: add an explanation to the message about what could have caused this to happen. The simplest would be a session having expired (if applicable), authorization revoked by accident, or whatever else could have caused the system to "think" they are no longer authorized to execute the action.

And add a way for them to remedy the situation. The dreaded "contact your administrator" comes to mind, though I would improve that with details of who that administrator is and how to reach him/her.

Improve this answer
0

The authorization rules set by the Super admin should be implemented asap.

The question arises what if a particular user is already in the system or edit mode ? The best solution would be to notify the user then and there that he/she is not authorized for the action he/she is trying to perform without wasting any time of that respective user. One should keep in mind that the action of the Super Admin has high priority and hence his actions should be reflected immediately.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.