You do not have permission to create an item here (Local Datasources)

Question

I'm working on security for an implementation and while testing use cases, I found that my authors are not able to create local datasources in the 'virtual page data' location that is hidden by default under pages.

So the 'data' folder shows up, but they can't create items there when clicking "create":

Is there a security setting that must be enabled for an author to use this? (keeping in mind that I'm using the principle of least privilege)

Thanks!

Answer 1

While trying to configure security for the users of our system, I found that I needed to grant access to the template used for the Data item; which I believe is a Virtual Page Data.

Example: The following applies security changes to the Data folders.

# This is a helper method to simplify the changes.
function New-AccessRuleList {
    [CmdletBinding()]
    [OutputType("System.Collections.Generic.List[Sitecore.Security.AccessControl.AccessRule]")]
    param(
        [string]$Identity,
        [string[]]$AccessRule,
        [Sitecore.Security.AccessControl.PropagationType]$PropagationType,
        [Sitecore.Security.AccessControl.SecurityPermission]$SecurityPermission
    )

    $list = New-Object "System.Collections.Generic.List[Sitecore.Security.AccessControl.AccessRule]"
    foreach($rule in $accessrule) {
        $list.Add((New-ItemAcl -Identity $Identity -AccessRight $rule -PropagationType $PropagationType -SecurityPermission $SecurityPermission))
    }

    @(,$list)
}

$allowItemProps = @{
    PropagationType = [Sitecore.Security.AccessControl.PropagationType]::Entity
    SecurityPermission = [Sitecore.Security.AccessControl.SecurityPermission]::AllowAccess
}

$realEveryone = "\Everyone"
$virtualDataItem = Get-Item -Path "master:" -ID "{9700DC24-8969-4638-ACC3-34D54335829E}"
$accessRules = New-Object Sitecore.Security.AccessControl.AccessRuleCollection
$accessRules.AddRange((New-AccessRuleList -Identity $realEveryone -AccessRule item:create @allowItemProps))
$virtualDataItem | Add-ItemAcl -AccessRules $accessRules

The final results:

Answer 2

I think you are encountering the bug described by Kris here https://kverheire.blogspot.com/2018/06/setting-sxa-security-roles-with-small.html (see "First issue" in the blog post).

The solution is:

1. Go to the item: /sitecore/system/Settings/Foundation/Experience Accelerator/Local Datasources/Virtual Page Data
2. Add the permission for the "Create" security right for all the needed users or role. (In this case that is the SXA Author created role)