Global navigation

   Documentation Center
   eZ Studio & eZ Platform
     User Manual
     Technical Manual
   eZ Publish 4.x / legacy

eZ Publish (5.x)

eZ Publish 5.x | For eZ Platform & eZ Studio topics see Technical manual and User manual, for eZ Publish 4.x and Legacy topics see eZ Publish legacy

Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

Version 1 Current »

PLATFORM >= 2015.09


eZ content repository uses the concept of roles and policies in order to authorize a user to do something (e.g. read content).

  • A role is composed of policies and can be assigned to a user or a user group.
  • A policy is composed of a combination of module and function (e.g. content/readcontent being the module and read being the function).
  • Depending on module and function combination, a policy can also be composed of limitations.

It is possible for any bundle to expose available policies via a PolicyProvider which can be added to EzPublishCoreBundle's DIC extension.


PolicyProvider is an object providing a hash containing declared modules, functions and limitations.

  • Each policy provider provides a collection of permission modules.
  • Each module can provide functions (e.g. "content/read": "content" is the module, "read" is the function)
  • Each function can provide a collection of limitations.

Limitations need to be implemented as limitation types and declared as services identified with ezpublish.limitationType tag.



An abstract class based on YAML is provided: eZ\Bundle\EzPublishCoreBundle\DependencyInjection\Security\PolicyProvider\YamlPolicyProvider.
It defines an abstract getFiles() method.

Extend YamlPolicyProvider and implement getFiles() to return absolute paths to your YAML files.


Extending existing policies

A PolicyProvider may provide new functions to a module, and additional limitations to an existing function. 
It is however strongly encouraged to add functions to your own policy modules.

It is not possible to remove an existing module, function or limitation from a policy.

Integrating the PolicyProvider into EzPublishCoreBundle

For a PolicyProvider to be active, it must be properly declared in EzPublishCoreBundle.
A bundle just has to retrieve CoreBundle's DIC extension and call 
addPolicyProvider(). This must be done in bundle's build() method.

Core policies

Policies used internally in repository services are defined in EzPublishCoreBundle/Resources/config/policies.yml.


  • No labels