when to create organisation and location organisation in liferay

Question

I have scenario as, I have say 5 branches for example Branch A, Branch B, Branch C etc. All branches have different set of users and different set of data(in liferay portlets). My requirement is like, Whenever user from Branch A logs in he should not able to logged in to other branch. In short he should not have any permission to view, login to Branch B (other than his own branch).

All 5 branches has two sub-sites. Eg. Branch A has sub sites Site A1 and Site A2. separate users are associated to the site.

My Question is what should I use to develop such system.

As of now I had created one Organisation and created Location Sub organisation.

• How can I restrict user to log in himself into his own organisation and not anyone else.
• How can I restrict user to view the contents on his own site and not other site.
• Do I need to create User Groups.

Any Pointers would be helpful. Thanks in advance.

Answer 1

First of all: You don't need Locations. They're just like Organizations, but can't have any more suborganizations. This is a limitation that you don't need to impose on your branche offices. You can, but don't need to.

You always log in to your account, not into an organization. When there's content in an organization's site that must not be seen by non-members of that organization, just make the pages private - this restricts them to be seen only by members of the organization.

Membership of organizations is centralized anyways - thus nobody can become member of another organization without an administrator making the connection.

If you need user groups depends on what your overall structure is. If you interface with LDAP, I like to use user groups as the importing target for LDAP groups. If you don't, it still might make sense to group users into User Groups - just to keep an overview over the different memberships and permissions that you give. It's a lot easier if you restrict yourself to not grant any roles and permissions to individual users, only to User Groups - at least once you have a certain number of users.