How to identify which users have access to particular item?

Question

I want to know the users who all have access Read/Write to particular item. How to fetch that info? is there any SQL table to extract?

Answer 1

You cannot do this via SQL query - you need to use Sitecore API. The reason is that Sitecore security model allows inheritance of access rights, breaking the inheritance and denying access rights. You cannot really read it from the tables directly.

Using API:

1. Get the user by the name:

var user = Sitecore.Security.Accounts.User.FromName(userName, false);

2. Check access write:

using (new Sitecore.Security.Accounts.UserSwitcher(user))
{
    bool canWrite = item.Security.CanWrite();
}

Now you only need to iterate through all the users and run that code for each of them. Something like this should do the trick:

Sitecore.Security.Accounts.UserManager.GetUsers();

---

EDIT after OPs comment: If you want to execute check for more items, you must either put your whole code inside using UserSwitcher block or use UserSwitcher.Enter and UserSwitcher.Exit like:

using (new Sitecore.Security.Accounts.UserSwitcher(user))
{
    bool canWriteParent = parent.Security.CanWrite();
    for (Item child in parent.Children)
        child.Security.CanWrite();
}

or

Security.Accounts.UserSwitcher.Enter(user);

bool canWriteParent = parent.Security.CanWrite();
for (Item child in parent.Children)
    child.Security.CanWrite();

// any other code

Security.Accounts.UserSwitcher.Exit();

Answer 2

If you are already logged into Sitecore, you can also use the built-in tools in the Sitecore interface, though they require a little more manual hunting to check all users.

Security Details

In the Content Editor, click the Details button of the Security ribbon tab:

This will open a tab in the content editor that shows you all the security for the assigned item, though it will not show you inherited security:

Access Viewer

Open it from the Security ribbon tab of the Content Editor to pre-select the currently-selected item:

It can also be opened directly from the LaunchPad or from the Sitecore menu in Desktop:

You can then select different items to see their security for specific accounts (change which account is to be tested by clicking the Account button in the Access Viewer ribbon).

Answer 3

Another option would be to generate a report using Sitecore Powershell Extensions:

function Get-Items () {
    # Set the item you want to check here
    $item = Get-Item -Path "master:/sitecore/content/"

    $finalUserList = New-Object System.Collections.Generic.List[System.Object]
    $users = [Sitecore.Security.Accounts.UserManager]::GetUsers()
    foreach ($user in $users) {
        New-UsingBlock (New-Object Sitecore.Security.Accounts.UserSwitcher $user) {
            if ($item.Access.CanRead()) {
                if ($item.Access.CanWrite()) {
                    $finalUserList.Add($user.Name)
                }
            }
        }
    }

    $finalUserList
}

$props = @{
    InfoTitle = "Check User Read+Write Access for an Item"
    InfoDescription = "Report for identifying if a user has Read and Write access to a specific item."
    PageSize = 100
}

Get-Items | Show-ListView @props -Property @{ Label = "User Name"; Expression = { $_ } }

Close-Window