0

We have a multi-app multi-site app structure like follows:

Commerce
  BE
    Pages
    Feature 1
    Feature 2
  DE
    Pages
    Feature 1
    Feature 2
  NL
    Pages
    Feature 1
    Feature 2
Business
  BE
    Pages
    Feature 1
    Feature 2
  etc

So we have different apps and every app has multiple country sites. We have defined a role per country per app, so we have the roles Commerce BE, Commerce DE, Commerce NL, Business BE, Business DE etc. These are access roles in the sense that they have access to the appropriate location in the content tree.

The problem now comes when we want to add an additional layer, namely for specific features. We would like to define the roles Feature 1 Admin, Feature 2 Admin etc. And users should only be able to edit a Feature subtree when they have rights to the country within an app AND have the appropriate feature role. The problem is that when you break inheritance for a feature template and assign rights to the template, a user who has the feature role, can now (theoretically) edit the feature subtree of other countries! Ok, the user would not see the content of other countries, but in the access viewer we see that the user has rights to the feature subtry of countries that he has no country role for.

How could we solve this problem?

  • How about you break inheritance at the very top in the content tree (at Commerce item) and assign roles per country ONLY? So a user would only then be able to edit that country. Since Sitecore Security works on Deny First principle your template role will not work until a user gets access to that country also. So a combination of two roles - Country and Template - will allow a user to edit a certain template type under a country they have access to and others will not be editable until you grant access to other country. – Gabbar Oct 25 '18 at 14:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.