Restricting certain users with read-only access to core and web database?

Question

I am looking into access viewer in Sitecore. My goal is to restrict certain users with just read-only access to core and web database. However these users need to have a write access to some items in the master database.

For this, I have created a new role and I plan to add those users to this specific role. However the problem arises when I try to set access rights, I do not see a distinction between the databases and I am thinking it will probably apply those permissions to all the databases. Hence I am not able to figure out a way to restrict core and web to read-only but master to read-write.

I was also wondering, if read-only access is not possible, can I deny the access to core and web databases entirely? I found this link: https://community.sitecore.net/developers/f/8/t/433 but it looks like this will only hide the databases in the tray icons and users would be still able to reach the databases by tweaking the url.

So, my question is : Is there a way to restrict read-only access to core and web databases. If not, is there a way to completely deny access to these databases for certain groups while setting different access rights for master database for those exact users.

Please let me know!

Thanks!

Answer 1

Aha, found a way to do this:

So looks like the important piece of functionality that I was unaware about, is that the Access Viewer only treats the permissions for the current database. So to set different permissions to different databases, I need to first switch a database, open the access viewer again and then set necessary permissions for the items in that database.

This also would explain why there is no "Database Selector / Switcher" which I was expecting inside Access Viewer.

To summarize, these are the steps that I followed:

1) Login as Admin.
2) Create a new role that I want to apply restrictions for.
3) Add all the necessary users to that particular role.
4) Open Access Viewer and assign appropriate permissions for that role.
5) Switch database either by using desktop view or url.
6) Repeat step 4 and 5 for all the required databases.

In my case, when I set up the permissions to the core database, 'database selector' disappeared from the sitecore tray in desktop view (which is already a good sign) and when I tweaked url to open core database, I did get a read-only view as I expected.

For reference, here is the screenshot of 'read-only' core database:

UPDATE:

This approach works well for core database. However for web database, since publishing can overwrite permissions, you would have to take some extra measures such as preventing publishing for certain items etc.

Answer 2

Your idea works but in the case where an admin publishes the entire site. If that happens then the permissions set in master will clobber the permissions set in web (or any other dbs that are being published to). Assuming you are setting these permissions on items that content editors will never need to edit (i.e. the item /sitecore) the following processor should allow for a way to avoid this issue:

Processor:

using Sitecore.Diagnostics;
using Sitecore.Publishing;
using Sitecore.Publishing.Pipelines.PublishItem;
using System.Linq;

namespace MyNamespace.Sitecore.Pipelines
{
    public class SkipItemsProcessor : PublishItemProcessor
    {
        public override void Process(PublishItemContext context)
        {
            Assert.ArgumentNotNull((object)context, "context");

            var idsToSkip = global::Sitecore.Configuration.Settings.GetSetting("Publishing.ItemsToSkip", string.Empty).Split('|');
            if (!idsToSkip.Contains(context.ItemId.ToString()))
                return;

            context.AbortPipeline(PublishOperation.Skipped, PublishChildAction.Allow, string.Empty, true);
        }
    }
}

Patch file:

<?xml version="1.0"?>
<configuration xmlns:patch="http://www.sitecore.net/xmlconfig/">
  <sitecore>
    <settings>
      <setting name="Publishing.ItemsToSkip" value="_Insert list of ids to skip_" />
    </settings>
    <pipelines>
      <publishItem>
        <processor type="MyNamespace.Sitecore.Pipelines.SkipItemsProcessor, MyDll" 
                   patch:after="*[@type='Sitecore.Publishing.Pipelines.PublishItem.CheckSecurity, Sitecore.Kernel']" />
      </publishItem>
    </pipelines>
  </sitecore>
</configuration>

It's definitely worth noting that this should be used very sparingly. It will essentially disable publishing for the chosen item(s) which can cause troubleshooting nightmares if abused. This has not been thoroughly tested.