MACROMEDIA CONTRIBUTE 3-DEPLOYING CONTRIBUTE User manual

CONTRIBUTE

3
Deploying Contribute

Trademarks
Add Life to the Web, Afterburner, Aftershock, Andromedia, Allaire, Animation PowerPack, Aria, Attain, Authorware,
Authorware Star, Backstage, Bright Tiger, Clustercats, ColdFusion, Contribute, Design In Motion, Director, Dream Templates,
Dreamweaver, Drumbeat 2000, EDJE, EJIPT, Extreme 3D, Fireworks, Flash, Flash Lite, Flex, Fontographer, FreeHand,
Generator, HomeSite, JFusion, JRun, Kawa, Know Your Site, Knowledge Objects, Knowledge Stream, Knowledge Track,
LikeMinds, Lingo, Live Effects, MacRecorder Logo and Design, Macromedia, Macromedia Action!, Macromedia Breeze,
Macromedia Flash, Macromedia M Logo and Design, Macromedia Spectra, Macromedia xRes Logo and Design, MacroModel,
Made with Macromedia, Made with Macromedia Logo and Design, MAGIC Logo and Design, Mediamaker, Movie Critic,
Open Sesame!, Roundtrip, Roundtrip HTML, Shockwave, Sitespring, SoundEdit, Titlemaker, UltraDev, Web Design 101, what
the web can be, and Xtra are either registered trademarks or trademarks of Macromedia, Inc. and may be registered in the United
States or in other jurisdictions including internationally. Other product names, logos, designs, titles, words, or phrases mentioned
within this publication may be trademarks, service marks, or trade names of Macromedia, Inc. or other entities and may be
registered in certain jurisdictions including internationally.
Third-Party Information
This guide contains links to third-party websites that are not under the control of Macromedia, and Macromedia is not
responsible for the content on any linked site. If you access a third-party website mentioned in this guide, then you do so at your
own risk. Macromedia provides these links only as a convenience, and the inclusion of the link does not imply that Macromedia
endorses or accepts any responsibility for the content on those third-party sites.
Apple Disclaimer
APPLE COMPUTER, INC. MAKES NO WARRANTIES, EITHER EXPRESS OR IMPLIED, REGARDING THE
ENCLOSED COMPUTER SOFTWARE PACKAGE, ITS MERCHANTABILITY OR ITS FITNESS FOR ANY
PARTICULAR PURPOSE. THE EXCLUSION OF IMPLIED WARRANTIES IS NOT PERMITTED BY SOME STATES.
THE ABOVE EXCLUSION MAY NOT APPLY TO YOU. THIS WARRANTY PROVIDES YOU WITH SPECIFIC
LEGAL RIGHTS. THERE MAY BE OTHER RIGHTS THAT YOU MAY HAVE WHICH VARY FROM STATE TO
STATE.
Copyright © 2002-2004 Macromedia, Inc. All rights reserved. This manual may not be copied, photocopied, reproduced,
translated, or converted to any electronic or machine-readable form in whole or in part without prior written approval of
Macromedia, Inc.
Acknowledgments
Project Management: Jennifer Rowe
Writing: Chris Bedford, Jennifer Rowe
Managing Editor: Rosana Francescato
Editing: Mary Kraemer, Barbara Milligan, Lisa Stanziano, Anne Szabla
Production Management: Patrice O’Neill
Media Design and Production: Adam Barnett, Christopher Basmajian, Aaron Begley, John Francis
Special thanks to Ken Sundermeyer, Eric Lerner, Chris Denend, Joel Huff, Lawson Hancock, Erik Larson, Sheila McGinn,
Emilio Passi, Yoko Bayer, Scott Richards, Melissa Baerwald, Deb Galdes, Kimberly Oslob, Dennis Griffin, Jon Varese,
Brady Kroupa, Josh Margulis, Gavin Anderson, Deeje Cooley, Vickie Chapman, Kaori McLister, and the Contribute engineering
and QA teams.
First Edition: July 2004
Macromedia, Inc.
600 Townsend St.
San Francisco, CA 94103

3
CONTENTS
Deploying Contribute to Departments and Enterprises . . . . . . . . . . . . . . . . . . . . . . . 5
Contribute deployment responsibilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Deployment tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Deployment issues. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
User management models . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Contribute user roles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Contribute and website security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Website connection distribution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Deploying Contribute across an organization . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Approvals and site structure. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Content design considerations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
Contribute Publishing Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Contribute case studies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

4 Contents

5
Deploying Contribute to Departments
and Enterprises
Macromedia Contribute is a website editor that lets people connect to departmental and other
websites so that they can update web page content. Administrative assistants, product managers,
human resource managers, and other people in an organization can use Contribute to update
their workgroup’s web pages without having to contact a web team or other departmental
resources.
The following examples show how Contribute might be used in an organization:
•Updating schedules
•Posting job requisitions
•Updating an employer’s work-related policies and guidelines
•Editing organizational charts
•Sharing information among team members through a departmental intranet
This chapter, which is intended for website administrators and IT professionals, describes the best
practices for deploying Contribute within an organization. It explains how to set up Contribute
in a variety of IT environments so that content editors and website administrators can enjoy the
power and flexibility of this application.
This chapter contains the following sections:
“Contribute deployment responsibilities” on page 6
“Deployment tasks” on page 7
“Deployment issues” on page 8
“User management models” on page 16
“Contribute user roles” on page 17
“Contribute and website security” on page 18
“Content design considerations” on page 24
“Contribute Publishing Services” on page 29
“Contribute case studies” on page 29

6 Deploying Contribute to Departments and Enterprises
Contribute deployment responsibilities
As a system or website administrator, you play a large part in deploying Contribute. The
deployment responsibilities include the following tasks:
•Installing the Contribute software.
•Creating connections to websites that users of Contribute (called content editors) access.
•Defining roles (a collection of privileges that you assign to a specific user or group of users).
Roles determine which users have, or are denied, access to a specific website.
•Installing Contribute on individual computers throughout your organization.
•(Optional) Integrating Contribute with Contribute Publishing Services.
The size of your organization and the job roles associated with your organization’s websites
determine who assumes responsibility for deployment. A single system administrator may be
responsible for all deployment, or other members of the organization’s web team or IT staff may
be involved. Administrators manage Contribute websites by controlling who has access to the site
and by specifying what kinds of changes content editors can make to a website.
Administrators, web masters, and web designers
If you are a system administrator, this might be your first time to work with web pages and web
content. Your role as a system administrator may intersect with the role of web designer. A web
designer can help you determine the editing and access requirements of your site and help you
construct the site so that users with limited web-design skills can easily update content.
Contribute gives you a great deal of power and flexibility in determining who can edit web pages
on a website and what types of changes they can make. For example, you might decide that all
Contribute users, with the exception of the web-design staff, are limited to editing text on web
pages, and that the web-design staff can edit text, apply new text styles (for example, change the
type font), and insert new images.
Contribute job functions
The following table describes the function of each role that relates to Contribute:
Role Function
Contribute administrator Responsible for installing Contribute, setting up user roles and privileges,
and determining the degree to which users can access and update
websites.
Contribute administrators are often members of an organization’s IT staff,
responsible for maintaining server and network infrastructure, managing
user and file permissions across an organization’s network.
System administrator Maintains web servers and web server access. This role often overlaps
with that of the Contribute administrator and may be handled by the same
person in smaller organizations.
Web designer Designs websites, determining their look and feel, and creates and
maintains the site’s content.

Deployment tasks 7
These roles vary from organization to organization. In smaller organizations and workgroups, a
single person may handle the job of administering Contribute and determining the design of the
website. Larger workgroups and departments may have a team of people involved in maintaining
their website.
Deployment tasks
The following table describes the tasks you need to perform to successfully deploy Contribute.
Web developer Develops web-based applications, such as for absence reporting and
financial reporting, distributed to users over the web.
Contribute user Contribute users range widely in their job tasks and computer experience.
What they have is common is the need to update web page content
quickly and easily. Using Contribute, they can easily connect to a website
and safely update its content without inadvertently introducing
malfunctions.
Task Description
Gather website
information
Gather information about your website’s infrastructure. You’ll need this
information to properly install and configure Contribute.
For more information, see “Information about your website” on page 8.
Configure network and
server permissions
Ensure that the network and server permissions allow read, write, and
modify access so that Contribute users can connect to the site and
update pages.
For more information, see “Understanding network and server
permissions” on page 9.
Install Contribute Install Contribute on the computer from which you’ll administer the site,
create a connection to the website using Contribute, and establish
yourself as the Contribute administrator for the site.
To learn more about creating an administrative connection, see
“Contribute administrative connections” on page 9.
Install Contribute
Publishing Services
(optional)
Contribute Publishing Services (CPS) is a suite of Java server
applications that lets you integrate Contribute with Lightweight Directory
Access Protocol (LDAP) or Active Directory services, and implement e-
mail notifications to keep Contribute users informed about the status of
their drafts in progress.
If you want to use the CPS, you must install and configure the Publishing
Service server on a Java application server.
For more information, see “Contribute Publishing Services” on page 29.
Configure Contribute to
work with your website
After you establish yourself as an administrator of a site, you can
configure the administrative settings so that Contribute works more
efficiently with your website.
For more information, see “About Contribute administrative settings”
on page 10.
Role Function

8 Deploying Contribute to Departments and Enterprises
In addition to the basic tasks described in the preceding table, you might want to further enhance
your website by designing it to be more easily maintainable or by adding additional functionality
by using CPS.
Deployment issues
The following sections describe issues you should be aware of when deploying Contribute in your
organization. As with all client software that provides access to centralized servers on a network,
Contribute requires that certain network and server file permissions be appropriately configured
for users. Before installing Contribute and deploying it to users, ensure that you have considered
the following issues and have appropriately configured your website environment for use with
Contribute.
This section contains the following topics:
“Understanding network and server permissions” on page 9
“Contribute administrative connections” on page 9
“About Contribute administrative settings” on page 10
“Contribute site structure” on page 11
“Network paths and web addresses (URLs)” on page 11
“Contribute network connection types” on page 12
Information about your website
Before you install Contribute, you must gather information about your organization’s website
infrastructure. You need to find the answers to the following questions:
•Where is the server on the network?
•Who can access the server?
•Do new users and permissions need to be created on the server?
•What type of network connection will you use to connect to the website?
•If you are using File Transfer Protocol (FTP) or Secure FTP (SFTP) to connect to the website,
what FTP software is being used?
•What web server software is in use, and where is the website’s root folder?
•What is the URL of the website?
Create Contribute roles Create Contribute roles based on the privileges and restrictions you want
to place on a user’s ability to access and edit pages within the site.
For more information, see “Contribute user roles” on page 17.
Deploy Contribute to
your user base
Deploy Contribute to your users, and send them connection key files so
they can access the website.
To learn more about distributing website connections, see “Website
connection distribution” on page 21.
Task Description

Deployment issues 9
Although these questions may seem obvious, it’s good to think about them before you create a
connection to your website with Contribute. The sections below will help to provide you with
background information on these questions, and how they relate to installing and configuring
Contribute.
Understanding network and server permissions
Contribute is unique in that it allows editing of web pages directly on the server hosting your
website. This level of server access makes network permissions and access control especially
important. There are at least three levels of permissions for every Contribute site: the permissions
defined by the network operating system (for instance, Windows or UNIX server software), the
permissions defined by the web server software, and the roles you define within Contribute.
Network permissions can be set in several ways through a variety of systems. Contribute always
adheres to the network permissions for read and write access to folders. It also obeys permissions
set through LDAP and similar systems. Contribute can never overwrite any server- or network-
level permissions.
Note: The server’s network and operating system permissions, and the web server software’s
permissions, always take precedence over Contribute permissions.
Whenever you provide access to a web server, you should take precautions to ensure that the
operating system of the server hosting the site, as well as the web server software itself (and the
FTP server, if you are using FTP), are secure. For the best practices related to securing your
website from accidental and malicious tampering, see the documentation provided with your
server’s operating system, FTP, and web server software.
Note: You can set folder permissions to allow a user or group of users to modify a folder and later
define more restrictive folder- or file-editing options when you define the Contribute user roles.
Related topics:
•“Contribute user roles” on page 17
•“Contribute and website security” on page 18
Contribute administrative connections
After you gather information about your website infrastructure and configure the network and
server permissions for appropriate read, write, and modify permissions, you must install a copy of
Contribute and create a Contribute administrator connection to the website.
As an administrator, you are responsible for configuring Contribute administrative settings,
identifying users, defining user roles, installing Contribute on each user’s computer, and
distributing connection information so that users can connect to the website.
When you set up the Contribute administrator user role, consider whether you will be the only
administrator of the website. If more than one person will be administering the site, you may
need to create a group e-mail account that notifies all administrators when a user encounters a
problem.
To learn more about creating a connection, see “Creating and Managing Website Connections” in
Macromedia Contribute Help.

10 Deploying Contribute to Departments and Enterprises
About Contribute administrative settings
Contribute administrative settings are a collection of settings that apply to all users of your
website. These settings let you fine-tune Contribute to provide a better user experience. The
Contribute administrative settings are as follows:
Users and Roles lets you add users to the site, and create, edit, and delete roles.
Administration lets you specify a primary administrator for the site, set an administrator
password, and remove administration.
Tip: Contribute does not require that you set an administrator password; however, you should create
a password to protect access to the administrative functions. If you fail to assign an administrator or
an administrative password, anyone with a Contribute connection to the site can make themselves an
administrator of that site.
Publishing Services lets you enable CPS. Publishing Services is a suite of applications running
on their own server that let you extend the capabilities of Contribute as well as providing
additional functionary for users of Contribute.
Note: If you will be using the Publishing Services User Directory service, you should enable
Publishing Services and the User Directory service before adding users to the site. When you start
the User Directory service, any users who have connected to the site are removed, and any
connection keys you might have sent to users become disabled. To learn more about Publishing
Services, see “User management models” on page 16 and “Contribute Publishing Services”
on page 29.
Web Server lets you configure Contribute to work with your website’s specific web server
configuration. Because all websites vary somewhat in how they are set up, the configuration
options in the Web Server dialog box let you specify settings specific to your website, which
Contribute might not be able to determine automatically.
To learn more about the web server configuration settings you can specify, see “Web server index
pages” and “Alternate website addresses” in Macromedia Contribute Help.
Rollbacks lets you enable rollback files and specify the number of rollback files to maintain on
the server.
To learn more about rollbacks, see “Enabling and disabling rollbacks” in Macromedia Contribute
Help.
New pages lets you specify the encoding used for characters in web pages and the default page
extension (.htm, .html, and so on) to use when creating new pages.
By default, the character encoding for new pages is set to Western, which applies to all English
and Western European languages. The default encoding is set from your computer operating
system’s default encoding. Additional options include Central European, Cyrillic, Greek,
Icelandic, Japanese, Traditional Chinese, Simplified Chinese, and Korean. If you want to create
pages that display characters for multiple languages, select UTF-8.
To learn more about preference settings for new pages, see “Specifying new page preferences” in
Macromedia Contribute Help.

Deployment issues 11
Related topics
•“Configuring Contribute administration settings” in Macromedia Contribute Help
Contribute site structure
The connection you create to a website with Contribute determines the network protocol to use
when accessing the site, the web address (URL) of the site, and the degree to which the site’s
structure is accessible to content contributors. Before creating a connection to a website, carefully
consider how users will access the site and what areas of the site they will need to access.
Network paths and web addresses (URLs)
When creating a connection to the website, Contribute prompts you to provide the web address
(URL) of the website, and the network connection information of the server and folder storing
the website. Both the web address and network path must point to the same folder in the website.
For example, suppose your website is located at the directory path
\\MyServer\wwwroot\sites\MySite, and the corresponding web address for this site is
www.MyServer.com/sites/MySite. When creating the connection, you must enter these values
correctly, so they point to the same folder.
To ensure that the website and network folder (or in the case of FTP and SFTP, the FTP folder)
are the same, Contribute uploads a temporary file using the path information you provide.
Contribute then attempts to read the temporary file through HTTP, using the web address you
provide. If Contribute succeeds in locating the temporary file, the paths match, and Contribute
creates the connection. If the paths don’t match, Contribute prompts you again for the correct
path.
Note: If your users will use FTP to connect to a website folder beneath the FTP Host folder, you must
provide an absolute path to the folder.
Contribute connection paths
As the administrator, you can establish a connection to the root folder in a website if you need
access to all the folders in that site. Alternatively, you can establish a connection to a higher-level
folder, depending on the access you and your users require.
The root of a Contribute site is defined when you create an administrative connection and select
the website folder to connect to. All folders from the root website directory and below are within
the Contribute site. Typically, you create a connection at the root of your website, and use the
Contribute Permissions settings to limit user access to specific folders in the site.
Contribute does not let you create overlapped (or nested) connection paths. For this reason, you
should create a connection to the highest required access level in the site structure. If you need to
limit users to folders below this level, you can use Contribute Permissions settings to specify
folder access and editing options. For information about roles, see “Contribute user roles”
on page 17.

12 Deploying Contribute to Departments and Enterprises
The following example shows overlapped connection paths:
connection1: www.mysite.com/intranet/
connection2: www.mysite.com/intranet/marketing
In the following example, the paths do not overlap:
connection1: www.mysite.com/intranet/marketing
connection2: www.mysite.com/intranet/finance
Contribute administrative files and folders
Contribute creates a special administrative folder (labeled _mm) that contains a shared settings
file in each website you create a connection to. The shared settings file contains information
about each role you define, including the administrator role and any site-wide settings you define.
Storing this information on the server lets you make changes to Contribute role and site-wide
settings, without having to resend connections to users. The changes are automatically applied
when the user connects to the site.
If you are creating multiple site connections for various sets of users, make sure that the
connection paths you define do not overlap (see “Network paths and web addresses (URLs)”
on page 11). As the administrator, you should create your connection at the highest level of access
pertinent to the website; you can define roles to allow users access at lower levels of the site,
depending on their specific access requirements.
To learn how to secure the administrative folder and the shared settings file it contains, see
“Restricting access to administrative folders” on page 19.
Related topics
•“Approvals and site structure” on page 22
Contribute network connection types
Contribute lets you connect to websites using one of several network connection types. The
connection type you choose depends upon the infrastructure of your website. For example, if you
are deploying Contribute to update a workgroup’s intranet site, you can, in most instances, use a
local area network connection. However, if the site is hosted through an ISP or other external
resource, you might need to use either an FTP, SFTP, or WebDAV connection.
The following sections discuss the Contribute configuration issues you must consider for various
network connection types:
•“Local area networks” on page 13
•“File transfer protocol (FTP)” on page 13
•“Secure FTP” on page 14
•“WebDAV” on page 15

Deployment issues 13
Local area networks
When Contribute is used to connect to a web server through a local network, the web server must
be visible to the local network. Contribute can also be used with virtual private network (VPN)
servers to ensure that all file transmissions occur behind your firewall. If the web server is not
visible to the local network, you can create an FTP connection with Contribute to work with the
website (if the server you’re creating a connection to has an FTP server installed).
To ensure that you are entering the correct network path, use the Browse button of the
Connection wizard to locate and select the network folder. If the path to the folder is correct,
but Contribute still cannot create a connection, verify that the folder has proper read/write
permissions.
Tip: Depending on how the server you are connecting to is configured, you might not be able to see
the complete path to the website folder. If you cannot connect to the server, make certain you are
using a fully qualified path.
To learn how to check your server’s network and folder permissions, see the documentation
supplied with your server operating system.
File transfer protocol (FTP)
Tip: If you will be using FTP to connect to a website, Macromedia recommends using SFTP. In
addition to providing a secure connection when transferring files to and from Contribute and your
website, SFTP is a more reliable connection protocol. To learn more about SFTP, and the benefits it
provides, see “Secure FTP” on page 14.
If users will be accessing the website using FTP, ensure that the folder has delete, overwrite, and
rename privileges enabled. When anonymous FTP is used, these options are typically disabled by
default so that users cannot update pages or add new pages to the website.
When you create an FTP connection, Contribute attempts to auto-detect the FTP path, checking
that the FTP folder is the same folder that contains your website files. If the folder paths don’t
match, Contribute can’t write to the page displayed by your browser and prompts you to enter the
correct path.
To ensure that you are entering the correct FTP path, use the Browse button of the Connection
wizard to locate and select the FTP folder. If the path to the folder is correct but Contribute still
can’t create a connection, verify that the folder has proper read, write, and modify permissions for
the user. If you are creating an anonymous FTP account, the server must be configured to support
delete, rename, and overwrite permissions for the anonymous user. In some cases, file permissions
on UNIX servers may be configured in a way that prevents Contribute from operating, especially
if the server doubles as a file server. For more information, see “Setting up a site connection in
Contribute” on the Macromedia Contribute Support Center.
To test whether FTP is set up correctly for an end user, you can transfer a test web page to the
server. Then, using the login settings you provide to the user, attempt to view the page in a
browser.

14 Deploying Contribute to Departments and Enterprises
Secure FTP
SFTP is a secure version of the FTP protocol. Like SSH, SFTP prevents unauthorized users from
gaining access to password and user information that is sent without encryption over the Internet.
Standard FTP sends the user ID and password as clear (that is, unencrypted) text, allowing
anyone monitoring your FTP data to see your user ID and password, as well the data being
transmitted. With SFTP, everything you transmit is encrypted, protecting it from monitoring by
intruders.
In addition to increased security, Macromedia recommends using SFTP because it’s a more robust
protocol that provides more reliable performance. The following reasons describe why SFTP is a
better protocol:
•A more strict protocol than FTP
•Supports functionality that FTP does not
•Is more efficient than FTP
•Does not conflict with firewalls, proxy servers, or routers
•Provides a secure connection over which to transfer files
To use SFTP with Contribute, you must have an SFTP server installed. You cannot use a standard
FTP server and simply select SFTP from the connection type choice within Contribute; the
connection will fail. You must also have Secure Shell 2 (SSH2) enabled on the server. Contribute
provides SFTP only over SSH2-protected network connections.
To learn more about SFTP, see the documentation supplied with your server’s operating system
and SFTP server. To learn more about SSH2, see the SSH Communications Security website at
www.ssh.com.
Note: Contribute supports only password-based authentication. Other authentication methods, such
as certificate-based authentication, public key, and Kerberos, are not supported.
FTP and SFTP file permissions
Typically, FTP servers are configured so that when they create (or write) a new file, the
permissions created for the file give the person uploading the file read/write permission and give
members within the permission group read-only access.
In the case of Contribute, this process can cause a problem when another user tries to edit a page.
Contribute can read the file, but when it attempts to copy the updated file back to the web server,
the FTP server’s file permissions prevent Contribute from writing the new file.
When configuring your FTP server to work with Contribute, be certain to configure the file
permissions that the FTP server creates for new files so that members of the permission group can
read and write the file. This issue typically occurs on UNIX servers. You should set the
permissions for files to umask 664, which provides read and write access to the file owner (the
person who created the file) and to the permissions group (which would include any users
needing to connect to the website to update the file).

Deployment issues 15
WebDAV
Web-based Distributed Authoring and Versioning (WebDAV) is a series of extensions to the
HTTP protocol that lets users collaboratively update and manage files on a website. A key feature
of the WebDAV protocol is file locking. Users connecting to a WebDAV-enabled site lock files
when they open the file for editing. This prevents a user of the same website from overwriting
another user’s changes.
To use Contribute with a WebDAV-enabled site, you must use a WebDAV server that supports
exclusive write locks. Exclusive write locks guarantee that only the lock owner (the person who
opened the file for editing) can overwrite the file.
Note: Some WebDAV servers support shared write locks, which allow two or more users to
collaborate concurrently on a web page. Contribute does not support shared write locks. If a user
opens a page using Contribute on a WebDAV-enabled site that uses shared locks, Contribute opens
the file only if it can create an exclusive lock. If another user is editing the file, Contribute informs the
user that the file is not available for editing.
When creating a connection to a WebDAV-enabled site, you must provide a WebDAV-specific
URL. This might consist of a specific port number used by the WebDAV site. For example,
suppose that this is the URL of your site:
www.mysite.com/
This might be the WebDAV URL:
www.mysite:81.com/
Appending the port number 81 to the site’s domain name specifies the network address used by
WebDAV.
WebDAV-enabled sites often have their own user name and password requirements. You can
create these on an individual basis, or you can create a group user name and password.
When creating a connection to a WebDAV site, you must not mix connection types (such as FTP
with WebDAV or local area network with WebDAV). You must use only the WebDAV
connection type. When you create a connection to a website using local area network, FTP, or
SFTP connections, Contribute uses its own file-locking mechanism to prevent users from
overwriting each other’s files. Contribute connections using these connection types cannot detect
files locked with WebDAV locks and could inadvertently open a file being edited by a WebDAV-
enabled connection.
To prevent users from setting up different connection types to a WebDAV-enabled site, do
one of the following:
•Tell users creating connections that they should use only the WebDAV connection type with
WebDAV-enabled sites.
•Send a connection key that allows only users connecting to the site to use WebDAV.
•Restrict local area network, FTP, and SFTP access to the server hosting the WebDAV-enabled
site.
For more information on WebDAV, see the WebDav Resources website at www.webdav.org.

16 Deploying Contribute to Departments and Enterprises
Contribute and directory services
Microsoft Active Directory and LDAP are protocols for accessing information directories. In the
case of directory services, a directory is like a phone book and not like a directory (folder) on your
computer. When connecting to an LDAP or Active Directory server, Contribute adheres to any
file/folder permissions set by the directory service. Contribute permissions are stored in an XML
file, at the root of your website, that contains specific controls for the Contribute editing
environment.
These Contribute permissions are layered on top of the directory service or the network/server
permissions and are applied globally. They are not assigned on a per-user basis; they are simply
groups of settings that Contribute reads when first connecting to a website. Contribute then
conforms to these settings during the editing process. Contribute administrators can specify
access to certain folders for different user groups.
In addition to working within the permissions set by your Active Directory or LDAP services, you
can integrate Contribute with your directory services by using the User Directory component of
Contribute Publishing Services (CPS). The User Directory is an application server you install that
lets you centrally manage users.
To learn more about Contribute user management models, and integrating Contribute with your
organization’s directory services, see “User management models” on page 16.
User management models
User management lets you add and remove user access to websites and create user roles that
restrict editing privileges within a site. User management also provides a mechanism that lets users
easily connect to a website. Contribute has two user management models, manual site
connections, and sites managed using the Publishing Services User Directory service.
Manual connections let you communicate connection information to users, who then create
their own connections, either by entering connection information in the Connection Wizard or
by importing a connection key file that you give them.
This user model works best for smaller workgroups and organizations. It allows you to quickly set
up Contribute, create a connection to your website, define the necessary user roles, generate
connection information for the website connection/user role, and send it to users in the form of a
connection key file.
Contribute Publishing Services lets you integrate Contribute with your organization’s LDAP or
Active Directory services, giving you the ability to add and remove user access to a website and
modify user roles without having to resend connection key files to users. You can also create a file-
based database, using an XML file to manually enter user names and passwords.
CPS is intended for larger organizations that have several Contribute users to manage. Publishing
Services lets you add and remove users from websites and roles without having to resend
connection information. When you create a connection to a website that uses Publishing Services,
you simply add users to a list that grants access to a given website and user role. When the user
access the website, the Publishing Services server prompts them for a user name and password.
After entering their user name and password, they are granted access to the website and the role
you’ve assigned to them.

Contribute user roles 17
To use Publishing Services, you must have a J2EE application server such as Macromedia JRun
installed.
To learn more about Contribute Publishing Services, including how to install and configure a
Publishing Services server, see the Contribute Publishing Services website at
www.macromedia.com/go/cps.
Related topics:
•“Contribute user roles” on page 17
•“Website connection distribution” on page 21
•“Contribute Publishing Services” on page 29
Contribute user roles
Contribute lets you control access to your website by creating roles. Roles are collections of
settings that you create, each of which may be assigned privileges by the administrator of the site.
The roles you create reflect different levels of access to page creation, editing and deletion of
content, page design, and approval.
You can define any number of Contribute roles and specify various options for each role you
create. Contribute roles are not based on system or network user groups. You can create the same
role for members of various workgroups and send them a connection. As long as the recipients
have appropriate access to the network and server, they can edit the website.
Default roles
Contribute has three default roles: Administrator, Publisher, and Writer
Administrator identifies the administrator of the site, who can create new roles and modify
existing ones, add users to the site, and send connections to new users so that they can access the
site. A site can have more than one person assigned to the administrative role.
Publisher identifies users who can create and edit pages as well as publish pages to the website.
Writer identifies users who can create and edit pages, but cannot publish pages to the website. A
user in the Writer role must send their pages for review to a user in a Publisher or Administrator
role who can publish the page to the site or send it back to the Writer for additional editing.
Depending on your website publishing needs, and the number of people adding content to your
site, you might only need to use the Administrator and Publisher roles. If you deploy Contribute
in an organization where website content must be approved before it’s published, you should use
the Administrator, Publisher, and Writer roles.
In general, you shouldn’t need to create too many roles for a website. If you are deploying
Contribute in a large organization that uses many internal websites to communicate information,
consider creating connections to Contribute from the individual websites and sending
appropriate roles to the users who are responsible for each site’s content.

18 Deploying Contribute to Departments and Enterprises
Example role assignments
As an example of roles you might create, consider an online magazine. The job functions
associated with producing a magazine include a publisher, managing editor, copy editor, writer,
and web designer. In addition, Contribute adds an administrator to maintain the magazine’s
website. Each role reflects separate access to article creation, approval, editing and deletion, page
design, and site maintenance.
The following table describes the roles and privileges related to Contribute.
To learn more about creating roles, and the settings that you can use to define a role, see
“Managing Users and Roles” in Macromedia Contribute Help.
Contribute and website security
As an administrator, one of your primary concerns is in maintaining the integrity of your IT
infrastructure. Contribute works within the security parameters of your network and server
operating systems, ensuring that those system’s safeguards take precedence over any access rights
granted within Contribute.
This section documents security issues that are specific to Contribute. For best practices on
securing your website, see to the documentation provided with both your server’s operating
system and web server software.
Job Title Contribute Role Privileges
System
administrator
Administrator Installs Contribute, creates connections to the website, and
defines Contribute roles appropriate to the magazine’s job
functions.
The system administrator consults the designer on how to set
up role settings so that other members of the magazine’s staff
have appropriate editing privileges within their area.
Publisher Publish Gives final approval to all articles on the website and can
publish final drafts of pages or send them back for additional
editing or writing.
Managing editor Publish Monitors drafts as they go from writers to copy editors and
keeps track of who is working on what article. The managing
editor approves articles before sending them to the publisher
for final approval and publication to the website.
Copy editor Writer Can edit any unlocked text on a page. The copy editor cannot
publish pages to the site; they send the edited articles to the
managing editor for approval.
Writer Writer Can edit any unlocked text on a page, insert images, and
apply pre-defined styles to text.
Web designer Administrator The designer creates new CSS styles and web page
templates to accommodate changing site designs, inserts
images and Flash content into pages, and adds assets to the
shared asset library for writers to insert into pages.

Contribute and website security 19
Related topics:
•“Understanding network and server permissions” on page 9
•“Secure FTP” on page 14
•“Contribute user roles” on page 17
Web page rollbacks
Rollbacks let you revert to a previous version of any published web page, providing you with a
level of file recovery. You do not have to roll back to the last published version; you can select any
version that Contribute has saved as a rollback file.
When you roll back to a previous version of a page, Contribute reverts to the previous text
contained in the version of the page you select. However, any assets imported into the page may
or may not be recovered. For example, suppose you update an image file outside of Contribute
and then replace the original image with another image using the same filename. In this case,
Contribute cannot roll back to the previous version of the image because Contribute does not
manage assets outside the web pages it creates.
Contribute does maintain the older version of an image if you use Contribute to edit the image in
an external application. Contribute considers images, Microsoft Word documents, and other
content that you edit in an external application as assets. You can roll back assets that you’ve edited
through Contribute the same way that you roll back pages.
For example, suppose you roll back from version C of a page to version A, and you used
Contribute to edit an image in version B. When you roll back to version A, you will not see the
current version of the image. You need to also roll back the image, independently of the page
rollback.
To learn more about rollbacks, see “Enabling and disabling rollbacks” in Macromedia Contribute
Help.
Restricting access to administrative folders
When you create a site connection, Contribute creates special files that are stored in folders whose
names begin with an underscore (such as _mm, _baks, and _notes). These folders may contain
files with user names, e-mail addresses, previous versions of web pages, and other types of meta
information used by Contribute. The underscore allows Macromedia Dreamweaver and
Contribute to distinguish between those folders and the other folders in your site.
Contribute and Dreamweaver use this naming convention to filter these special files and prevent
them from appearing in the Dreamweaver Site panel and in the Contribute Remote File Browser.
These hidden folders can’t be browsed, overwritten, or inadvertently altered by users.
Additionally, some search engines and automated programs are designed not to return pages
found in folders whose names begin with an underscore.
To ensure that these folders and files remain protected, review the configuration of your web
server software and make certain that you block HTTP access to folders whose names begin with
an underscore ( _mm, _baks, and _notes), the MMWIP folder, and files identified by the file
extensions .lck, .mno, .bak, .lbi, .csi, and .dwt.

20 Deploying Contribute to Departments and Enterprises
In particular, you might want to block HTTP access to the MMWIP folder. The MMWIP folder
contains interim drafts of files (works in progress) that you might want to protect. Macromedia
recommends that you restrict access to the MMWIP folder so that only members of your
organization can browse files within that folder.
Note: In addition to using the computer’s operating system and web server software configuration
settings, you might consider using a third-party URL scanner to block HTTP access to secure these
files and folders.
Related topics
•“Contribute site structure” on page 11
•“Staging servers and Contribute” on page 21
•“Approvals and site structure” on page 22
Apache web servers
If your website uses Apache, you can explicitly disable browsing folders and files that begin with
an underscore. If you know how to modify the Apache web server’s httpd.conf file and have
permission to do so, you can use the DirectoryMatch directive to prevent visitors from viewing
any file in a folder beginning with an underscore.
If you’re not sure how to edit the Apache httpd.conf file or don’t have permission to do so, ask
your system administrator or Internet service provider (ISP) to do it for you. To learn more about
limiting access to files and folders, and other security issues relevant to the Apache web server, see
the documentation supplied with your Apache distribution.
Microsoft IIS web servers
To prevent unauthorized users from accessing Contribute administrative folders under Microsoft
IIS, use access control lists (ACLs) to prevent read access by unauthenticated users of the
operating system as well as by clients connecting to IIS. When you use ACLs to restrict access,
only properly authenticated users can view the contents of the Contribute administrative folder.
Anonymous web clients, or other users with access to the server, cannot view the administrative
folder and its contents.
Note: When setting permissions for Contribute administrative folders, ensure that Contribute has
read/write access to the administrative folders and the files they contain. Contribute uses the settings
in these files to enforce role settings of users connecting to the site.
In addition to securing the administrative folders using the operating system’s permissions and
access control lists, you should consider using UrlScan to further secure IIS web servers. UrlScan
is a security tool provided by Microsoft that screens incoming requests to the server by filtering
the requests based on rules that you create. Filtering requests helps secure the server by ensuring
that only valid requests are processed.
To learn more about the UrlScan utility, see the Microsoft website at www.microsoft.com.