6

I'm working on security for an implementation and while testing use cases, I found that my authors are not able to create local datasources in the 'virtual page data' location that is hidden by default under pages.

So the 'data' folder shows up, but they can't create items there when clicking "create":

SXA You do not have permission to create an item here

Is there a security setting that must be enabled for an author to use this? (keeping in mind that I'm using the principle of least privilege)

Thanks!

7

While trying to configure security for the users of our system, I found that I needed to grant access to the template used for the Data item; which I believe is a Virtual Page Data.

Example: The following applies security changes to the Data folders.

# This is a helper method to simplify the changes.
function New-AccessRuleList {
    [CmdletBinding()]
    [OutputType("System.Collections.Generic.List[Sitecore.Security.AccessControl.AccessRule]")]
    param(
        [string]$Identity,
        [string[]]$AccessRule,
        [Sitecore.Security.AccessControl.PropagationType]$PropagationType,
        [Sitecore.Security.AccessControl.SecurityPermission]$SecurityPermission
    )

    $list = New-Object "System.Collections.Generic.List[Sitecore.Security.AccessControl.AccessRule]"
    foreach($rule in $accessrule) {
        $list.Add((New-ItemAcl -Identity $Identity -AccessRight $rule -PropagationType $PropagationType -SecurityPermission $SecurityPermission))
    }

    @(,$list)
}

$allowItemProps = @{
    PropagationType = [Sitecore.Security.AccessControl.PropagationType]::Entity
    SecurityPermission = [Sitecore.Security.AccessControl.SecurityPermission]::AllowAccess
}

$realEveryone = "\Everyone"
$virtualDataItem = Get-Item -Path "master:" -ID "{9700DC24-8969-4638-ACC3-34D54335829E}"
$accessRules = New-Object Sitecore.Security.AccessControl.AccessRuleCollection
$accessRules.AddRange((New-AccessRuleList -Identity $realEveryone -AccessRule item:create @allowItemProps))
$virtualDataItem | Add-ItemAcl -AccessRules $accessRules

The final results:

Security Settings On Item

  • Thanks @Michael! Setting the permissions to 'create' on the item let my author role create these datasources! – Craig Taylor Dec 16 '18 at 16:06
3

I think you are encountering the bug described by Kris here https://kverheire.blogspot.com/2018/06/setting-sxa-security-roles-with-small.html (see "First issue" in the blog post).

The solution is:

  1. Go to the item: /sitecore/system/Settings/Foundation/Experience Accelerator/Local Datasources/Virtual Page Data
  2. Add the permission for the "Create" security right for all the needed users or role. (In this case that is the SXA Author created role)
  • +1'd. Thanks @Gatogordo. Yes, adding the proper permissions enabled this to work! – Craig Taylor Dec 16 '18 at 16:09

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.