Just like employees of companies in the real world, users in the system can carry out different tasks. Some of them may deal with the management of the entire intranet—creating new organizations, locations, user groups, and sites; assigning users; and setting permissions. The others may be responsible for the configuration of specific sites and their pages, and managing portlets. There can also be a group of users who are responsible for creating and posting content. What is more, it is also possible that the same user can be an administrator of one of the sites, but at the same time, not be able to do anything except view the content of another. To enable the management of such a complex net of allowances, Liferay introduced the role functionality, which allows us to define what actions can be performed by which users in defined places.

A role is a collection of actions that can be performed by users assigned to that particular role. There are three types of roles defined at...