Sitecore admin pages non-admin access

Question

Is there a way to give access to a users to the /sitecore/admin/* pages without giving them access to the admin role?

Answer 1

There is no general rule that tells Sitecore to force user to login when they access /sitecore/admin/* url.

However most of the pages there (or maybe all) inherits from the Sitecore.sitecore.admin.AdminPage class and they check if user is administrator (Context.User.IsAdministrator).

Here is part of the AdminPage class code:

protected void CheckSecurity()
{
  this.CheckSecurity(false);
}

protected void CheckSecurity(bool isDeveloperAllowed)
{
  if (Context.User.IsAdministrator || isDeveloperAllowed && this.IsDeveloper)
    return;
  SiteContext site = Context.Site;
  if (site == null)
    return;
  this.Response.Redirect(string.Format("{0}?returnUrl={1}", (object) site.LoginPage, (object) HttpUtility.UrlEncode(this.Request.Url.PathAndQuery)));
}

private bool IsDeveloper
{
  get
  {
    if (!this.User.IsInRole("sitecore\\developer"))
      return this.User.IsInRole("sitecore\\sitecore client developing");
    return true;
  }
}

and here is Page_load from the ShowConfig class responsible for /sitecore/admin/showconfig.aspx url:

protected void Page_Load(object sender, EventArgs e)
{
  this.CheckSecurity();
  XmlDocument configuration = Factory.GetConfiguration();
  this.Response.ContentType = "text/xml";
  this.Response.Write(configuration.OuterXml);
}

So as you see, it's impossible to allow to access such a page without being administrator. Unless you create your own e.g. ShowConfig class and use this.CheckSecurity(true) (which will allow access for developers as well) or make completely custom implementation for the pages there.

Answer 2

In my opinion it might be best to create a new role. You can give that role access to the things that they should be able to do. Then assign it to the user you want to mimic as an admin.

Answer 3

You can add your own aspx page to the admin folder and bypass admin.

Don't inherit anything and then check that they're logged in:

if (Sitecore.Context.User.IsAuthenticated)

I wouldn't recommend doing this though, just because probably it is best to keep admin pages for admins.