Extranet FAQ #

This page is for managers and project leads who need quick answers about portals for people outside the company. Each answer is short and links to the page with the details.

Contents #

1. Separation and access
2. Accounts
3. Address and design
4. Files and ordering
5. Security and records
6. Related pages

Separation and access #

Can one partner see another partner's documents? Not when each organization's folder is readable only through a role assigned to that organization's group with a Subtree limitation, and tested (Customer and partner areas).

Do we need a separate role for every partner? No. One role, assigned to each organization's group with its own Subtree limitation, serves every organization (Roles and policies, 5).

Can Gold partners see more than Silver partners? Yes, with a section per tier and a reading role per tier (Customer and partner areas, Tiers with sections).

Can an item move from internal to partners to public without being moved? Yes, with an object state group used in the reading policies (Customer and partner areas, Audiences that change).

Does search show partners things they may not read? No. Search results follow permissions (Intranet search).

Accounts #

Can partners register themselves? Yes, if the Anonymous role has user/register. New installations do not give it by default (Roles and policies, 8).

Can we approve each registration before it works? Yes. The administrator's mail carries signed Approve and Reject links; with an Approve workflow the account waits until someone decides (Registration and account approval).

Are the approve links in the mail safe if a mail scanner opens them? Yes. Opening a link changes nothing; the approver must be signed in with the right policy and confirm by pressing a button. Links are signed, expire after 7 days by default and approve or reject only once (Signed links, Security).

How do we close accounts when a contract ends? Remove the organization's assignments, then disable or deactivate and move its accounts (Extranet permissions review, When a partnership ends).

Can partners sign in with their own company accounts? Single sign-on with a partner's identity provider is not built in. The kernel has LDAP and text file login handlers and an extension point for single sign-on handlers (Directory sign-in and LDAP). The sevenx_authentication_2fa extension offers social login with providers such as Google, off by default (Two-factor and sign-in, Social login).

Address and design #

Can the portal have its own address? Yes. A siteaccess matched by host, such as partners.example.com, in the same installation as the public site (Separate hosts and siteaccesses).

Can partners use the portal but not sign in on the public site, or the other way round? Yes. user/login can be limited by siteaccess in each role (kernel/user/module.php).

Can partners land on their own page after signing in? Yes, with LoginRedirectionUriAttribute[group], a text attribute of the user group that holds the address (Customer and partner areas).

Can the portal look different from the public site? Yes. Each siteaccess has its own design, and templates can differ by section (Separate hosts and siteaccesses, Its own look).

Files and ordering #

Is a forwarded download link a risk? No. Every download checks that the person may read the file (Sharing files with partners).

Can partners upload files? Yes, into their own folder, with a role limited to the File class and their subtree (Sharing files with partners, Letting partners upload).

Can dealers order at their own prices? They can order through the built-in shop, and discount groups give user groups a percentage off products or classes. Fixed price lists per dealer are not a documented feature (Dealer and supplier portals).

Does the shop manage stock or invoices? No. Stock, accounting invoices, shipping labels and marketplaces are extensions or integrations (Running a shop, What the shop does not do).

Security and records #

Can we require two-step sign-in for partners? Yes, with sevenx_authentication_2fa and Enforce2FA=enabled (Two-step sign-in).

Can we prove who had access and what changed? The audit trail records sign-ins, refusals, role assignments and content changes in a tamper-evident log (The audit trail).

How often should we review access? At a fixed rhythm you agree with your security officer; the review routine is in Extranet permissions review.

Related pages #

• Extranets and partner portals
• Intranet FAQ
• Member site FAQ
• Businesses FAQ
• Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.