4

I want to know the users who all have access Read/Write to particular item. How to fetch that info? is there any SQL table to extract?

6

You cannot do this via SQL query - you need to use Sitecore API. The reason is that Sitecore security model allows inheritance of access rights, breaking the inheritance and denying access rights. You cannot really read it from the tables directly.

Using API:

  1. Get the user by the name:
var user = Sitecore.Security.Accounts.User.FromName(userName, false);
  1. Check access write:
using (new Sitecore.Security.Accounts.UserSwitcher(user))
{
    bool canWrite = item.Security.CanWrite();
}

Now you only need to iterate through all the users and run that code for each of them. Something like this should do the trick:

Sitecore.Security.Accounts.UserManager.GetUsers();

EDIT after OPs comment: If you want to execute check for more items, you must either put your whole code inside using UserSwitcher block or use UserSwitcher.Enter and UserSwitcher.Exit like:

using (new Sitecore.Security.Accounts.UserSwitcher(user))
{
    bool canWriteParent = parent.Security.CanWrite();
    for (Item child in parent.Children)
        child.Security.CanWrite();
}

or

Security.Accounts.UserSwitcher.Enter(user);

bool canWriteParent = parent.Security.CanWrite();
for (Item child in parent.Children)
    child.Security.CanWrite();

// any other code

Security.Accounts.UserSwitcher.Exit();
  • That's not what I would expect. item.Security.CanRead should take into account inherited access rights as well. Are you sure you switched context to that user? Have you checked with Access Viewer application if user has that access? Maybe there is some Deny rule which does not allow user to read that item? – Marek Musielak Nov 19 '18 at 8:55
  • Sure will check...Marek and will update – user8927358 Nov 19 '18 at 9:45
  • It worked....I have one more doubt...my requirement is to get access info for parent first, if it returns false I will check for child items. If any of the child item has access return true. If parent and none of the child items has access then return false. Do I have to use switch user everytime I use this .canread function? – user8927358 Nov 22 '18 at 4:50
  • I edited the answer with comment for your latest question – Marek Musielak Nov 22 '18 at 6:46
  • Thank you so much marek....one last question...I am trying to give role wise access now... creating a role and adding the same user to that role and giving access to the role...In this case also I can use the same code right? Else is there any separate API to check the role-wise access? It would be great if you can provide some links for reference also so that i can explore – user8927358 Nov 22 '18 at 7:38
1

Another option would be to generate a report using Sitecore Powershell Extensions:

function Get-Items () {
    # Set the item you want to check here
    $item = Get-Item -Path "master:/sitecore/content/"

    $finalUserList = New-Object System.Collections.Generic.List[System.Object]
    $users = [Sitecore.Security.Accounts.UserManager]::GetUsers()
    foreach ($user in $users) {
        New-UsingBlock (New-Object Sitecore.Security.Accounts.UserSwitcher $user) {
            if ($item.Access.CanRead()) {
                if ($item.Access.CanWrite()) {
                    $finalUserList.Add($user.Name)
                }
            }
        }
    }

    $finalUserList
}

$props = @{
    InfoTitle = "Check User Read+Write Access for an Item"
    InfoDescription = "Report for identifying if a user has Read and Write access to a specific item."
    PageSize = 100
}

Get-Items | Show-ListView @props -Property @{ Label = "User Name"; Expression = { $_ } }

Close-Window

enter image description here

  • There are some ACL commands for checking and assigning security. – Michael West Nov 21 '18 at 3:40
3

If you are already logged into Sitecore, you can also use the built-in tools in the Sitecore interface, though they require a little more manual hunting to check all users.

Security Details

In the Content Editor, click the Details button of the Security ribbon tab:

Security details button in content editor

This will open a tab in the content editor that shows you all the security for the assigned item, though it will not show you inherited security:

Security details tab

Access Viewer

Open it from the Security ribbon tab of the Content Editor to pre-select the currently-selected item:

Access viewer from content editor

It can also be opened directly from the LaunchPad or from the Sitecore menu in Desktop:

Access viewer in desktop menu

You can then select different items to see their security for specific accounts (change which account is to be tested by clicking the Account button in the Access Viewer ribbon).

Access viewer

  • I am trying to build a SOAP service....to check particular item access...So accessing through API is required – user8927358 Nov 19 '18 at 6:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.