CB Subs, Joomla ACL or both - best combination?

I have a question about what is best for my (project-sharing) site which is for an educational organisation that needs certain areas only visible to tutors/staff. So, things like certain articles, categories, menus and modules only show to those assigned a particular user status (or group).

I've been learning about Joomla's ACL (Access Control Lists) which can help me control the above access levels. The site is using CB 1.9 and GJ2.7 on a J2.5.9 site (plus Kunena and uddeIM).

What I'm wondering is; is there any particular benefit to me adding CB Subs to the site, or if there are any precautions in how I should be integrating Joomla's ACL with either CB+GJ or CB+GJ+CB Subs?

Thinking about all the permutations of ACL, Users and Groups, it seems there may be some cross-over of interests between the various systems (CB+GJ/CBSubs/ACL), each one potentially able to control access at certain levels... it's all getting to be a bit of a muddle in my mind!

So, there will be a general shared Student and Tutors projects' area, a Tutors only projects' area, and a "guest/temporary tutors" area. I am also realising it would be useful to have an extra Sandbox/Demo area.

This is all for a free (internal use only) project-sharing site where anyone within the organisation can upload and share their ideas and feedback with others using files, articles, videos, blogs, etc., within their assigned user/group access level.

Do you have any advice or suggestions on which is the best direction to follow in setting this up properly (and/or simply)?

What I'm wondering is; is there any particular benefit to me adding CB Subs to the site, or if there are any precautions in how I should be integrating Joomla's ACL with either CB+GJ or CB+GJ+CB Subs?

Depends on what you're wanting. ACL will only take you so far. One of the biggest benefits of CBSubs is its ability to protect URLs. So for extensions that don't have very deep ACL usage (which is fine) you can use CBSubs to protect a URL in that extension instead.

Thinking about all the permutations of ACL, Users and Groups, it seems there may be some cross-over of interests between the various systems (CB+GJ/CBSubs/ACL), each one potentially able to control access at certain levels... it's all getting to be a bit of a muddle in my mind!

CB and GJ control nothing. ACL and CBSubs are your only controlling factors here and they play well with one another. GJ has nothing to do with ACL, it simply provides community groups for users to interact with one another in; it does have access permissions based off ACL though so it's easy to set who can do what.

So, there will be a general shared Student and Tutors projects' area, a Tutors only projects' area, and a "guest/temporary tutors" area. I am also realising it would be useful to have an extra Sandbox/Demo area.

Maybe GroupJive can handle this entirely? Have 1 GJ category for Tutors, 1 for Students, and 1 for Guests? Then they can create groups as needed in the category they've access to. The groups allow communication and sharing between the members of that group.

One of the biggest benefits of CBSubs is its ability to protect URLs.

Does that mean ACL can't protect a URL, i.e. if someone knows the URL to a resource then content can be seen?

So for extensions that don't have very deep ACL usage (which is fine) you can use CBSubs to protect a URL in that extension instead.

Not sure how one would know if a [Joomla?] extension has deep ACL usage or not (if that's what you mean)? I've just started using the add on component "ACL Manger" which seems to enable more/easier control of ACL (and can fill-in any missing assets/permissions). Does that solve the problem, or is adding CBSubs still an overall advantage?

Does that mean ACL can't protect a URL, i.e. if someone knows the URL to a resource then content can be seen?

An internal Joomla menu link can have specific access view levels. When trying to access a page with its Itemid the access will be denied. CBSubs can go much deeper then this in that it doesn't need a menu item and you simply provide it a URL path to protect. Example as follows

option=com_comprofiler&task=userDetails

In CBSubs that'd protect profile edit with a CBSubs plan.

Not sure how one would know if a [Joomla?] extension has deep ACL usage or not (if that's what you mean)? I've just started using the add on component "ACL Manger" which seems to enable more/easier control of ACL (and can fill-in any missing assets/permissions). Does that solve the problem, or is adding CBSubs still an overall advantage?

CBSubs is independent of ACL. It protects content using Plans, like we do with our Advanced, Professional, etc.. subscriptions. So you could combine both for all sorts of protection. It's really entirely up to you. I'd explore using strictly ACL and if it can't protect everything you're needing protected then you may need CBSubs to protect content further.

As always, many thanks for your helpful advice.

Will carry on with ACL for now (that's hard enough to get my head around for now without adding CBSubs into the mix!)