How to check access permissions on items for a user via the Security API?

Question

I am trying to check Read permission for the current user on a specific item like the following:

Sitecore.Data.Database.GetDatabase("master")
    .SelectItems("/sitecore/content/Settings/Item1")[0]
    .Security.CanRead(Sitecore.Context.User)

This always returns true even though the 'Access Viewer' shows revoked 'Read' permission for the same user.

The revoking has been done using Roles.

What is wrong with this code?

UPDATE:

This code is being run from publish:begin event. The Sitecore.Context.User does have the required (logged-in) user. I see this on the AccessViewer (I have edited the code to CanWrite()): But both options mentioned in the answers always return True.

Answer 1

The code you have posted will always return true by the nature of how Sitecore security works. If SelectItems() returns an item, that means the Sitecore.Context.User can read it. If the current user did not have access to the item, it would return null.

So you have options depending on your use case. If you just want to restrict the current context users read access to an item, then just set the security on the item, the Sitecore API will do the rest for you.

If you want to check a users security, then you need to be logged in as someone who has read access and then use a User object to check the secuity.

var user = Sitecore.Security.Accounts.User.FromName(domainUser, false);
var item = Sitecore.Data.Database.GetDatabase("master")
    .SelectItems("/sitecore/content/Settings/Item1")[0];

// Option 1, pass in the user
var readAccess = item.Security.CanRead(user)

// Option 2, use a switcher
using (new Sitecore.Security.Accounts.UserSwitcher(user))
{
   readAccess = item.Access.CanRead();
}

Answer 2

Thought I would introduce you to something with a change in approach.

Sitecore PowerShell Extensions

Example: The following returns the security objects associated with an item. No results indicate nothing specified explicitly.

$path = "/sitecore/content/Concentra/DotCom/usa/Home"
Get-Item -Path $path | Get-ItemAcl

Account                          AccessRight          PermissionType   PropagationType  SecurityPermission
-------                          -----------          --------------   ---------------  ------------------
sitecore\michael                 item:read            Access           Entity           AllowAccess

Example: The following returns a true/false value indicating that the user has item:read access to the item.

$user = "sitecore\michael"
$path = "/sitecore/content/Concentra/DotCom/usa/Home"
Test-ItemAcl -Identity $user -Path $path -AccessRight item:read
True

Reporting

We also have a report in SPE called Items with security for an account.

Answer 3

Can you try :

Sitecore.Security.Accounts.User user = Sitecore.Security.Accounts.User.FromName(domainUser, false);
// UserSwitcher allows below code to run under a specific user 
using (new Sitecore.Security.Accounts.UserSwitcher(user))
{
   var ReadAccess = item.Access.CanRead();
}

Update:

This is the definition of method CanRead :

public virtual bool CanRead()
{
    return this.IsAllowed(this._item, AccessRight.ItemRead);
}

What namespace are you using for your CanRead method because I don't find this method with parameters?

Update2:

Looks like you use this method :

public virtual bool CanRead(Account account)
{
    Assert.ArgumentNotNull(account, "account");
    return AuthorizationManager.IsAllowed(this._item, AccessRight.ItemRead, account);
}

from the class: Sitecore.Security.AccessControl.ItemSecurity .

Please change your code and use my example or Richard example.

Answer 4

I was also facing that same issue (read access was always true, even check with user viwer in sitecore), So I tried an alternative to achieve the solutions:

string accessValue = standardFieldValueItem.Fields["__Security"].Value; string[] spliter = new string[] { "au|" };

string[] usersAccess = accessValue.Split(spliter, StringSplitOptions.None); bool isNotReadAccess = false; foreach (var userAccess in usersAccess) { if (userAccess.Contains(u.DisplayName)) { isNotReadAccess = userAccess.Contains("-item:read"); } }