Allow hyphens for Sitecore security roles?

Question

We are implementing a customer's membership and roles database that is used in multiple applications. They have used hyphen in the role names, which is generally allowed but Sitecore does not allow by default. If we try to edit the security settings for an item with a hyphenated row, it throws an error saying the role name is invalid.

Is there any way to get Sitecore to allow hyphens in the role names?

Answer 1

No.

I actually opened a support ticket for this back in February 2017, where I questioned the restrictions put forth by the "Create Role" dialogue box. I felt it was being too restrictive, since the underlying API did, as you mention, allow dashes in role names.

The answer I got was; that while overriding the "Create Role" dialogue is indeed possible, it would create unwanted side effects and I should refrain from doing it.

Listed side effects were:

• A Created role cannot be deleted;
• Unexpected exceptions connected with internal implementation;
• Access provided to the created role cannot be applied.

The last bullet is the one you experience.

It was registered as a future feature request, but if I'm honest I probably wouldn't hold my breath on that one.

Feature Request ID: 147168 - in case you want to escalate this with your local Sitecore representative.

Answer 2

The restrictions on the creation of the roles is hardcoded into the "Create Role" dialog box. You have a couple of options to work around this.

Directly at database level

Create the roles as you normally would using spaces, then update the role name with hyphens in the aspnet_Roles table in the core database:

UPDATE [dbo].[aspnet_Roles]
   SET [RoleName] = 'sitecore\role-with-hyphen',
       [LoweredRoleName] = 'sitecore\role-with-hyphen'
 WHERE [RoleName] = 'sitecore\role with spaces'

In most cases, creating Roles will not be a frequent task, so updating the database directly should not be an issue. Additionally, you can package up roles and security using the Sitecore Package Designer and/or they should be serialized using TDS or Unicorn.

Override the Create Role dialog

If you are uncomfortable updating SQL tables directly, then you can override the Create Role dialog.

1. Make a copy of website\sitecore\shell\Applications\Security\RoleManager\NewRole.xaml.xml and place it in the website\sitecore\shell\Override folder
2. Edit the file and change the inherits attribute to your own class, e.g. <Sitecore.Shell.Applications.Security.RoleManager.NewRole x:inherits="MyProject.Custom.Security.RoleManager.NewRolePage,MyProject.Custom">
3. Create a class, inherit from Sitecore.Shell.Applications.Security.RoleManager.NewRolePage and override the OK_Click method.

public class NewRolePage : DialogPage
{
    protected override void OK_Click()
    {
        string text = this.Name.Text;
        if (!SecurityUtil.IsValidRoleName(ref text)) /* update this check with the requierd logic */
        {
            SheerResponse.Alert("The role name \"{0}\" contains illegal characters.\n\nThe role name can only contain the following characters: A-Z, a-z, 0-9, ampersand and space.", new string[1]
            {
                text
            });
        }
        else
        {
            SheerResponse.SetDialogValue("{0}\\{1}".FormatWith((object) this.Domain.SelectedValue, (object) text));
            base.OK_Click();
        }
    }
}

Assigning Security

These solutions have not been thoroughly tested, and it would be wise to heed the advice the Mark provided in his answer, but the following is possible:

• Roles can be deleted, with or without hyphens
• Roles can be assigned to other roles without or without hyphens (Role in Roles)
• Access can be assigned to item using Security Editor and viewed using the Access Viewer
• Roles can be packages using the Package Designer and then installed using the Installation Wizard

I have tested this in Sitecore 8.1 update-1 and Sitecore 8.2 update-6.

The main area of caution would be any unexpected exceptions connected with internal implementation, but note that Sitecore stores Permission details against items as a string. If you had roles set up in Active Directory with hyphens for example, then Sitecore would use the role name (i.e. not use a GUID as an identifier).

However, all that said, since these are roles in Sitecore which you have control over, then I highly recommend you forgo the use of hyphens in role names and just use spaces. Since you mention "membership and roles database that is used in multiple applications", I highly recommend you do not apply security against non-Sitecore roles. Instead, create a [matching] role in Sitecore, apply security to this role, and then make the external role a member of this role.

Answer 3

Another option:
a) Create the role using Role Manager using only allowable characters
b) Serialize the role
c) Go to [sitedir]\Data\serialization\security\EPSVC\Roles
d) Edit the file, change the role name as desired. Leave the file name as-is.
e) Revert the role using Role Manager. This will effectively create a new role.
f) Delete the role from (a).

Note all the caveats mentioned above.