5

Is it possible to set restrictive extranet group permissions on a page-level item, and still have that page render, albeit differently, to users without the correct permission i.e. present a call to action. I don't want to redirect the user away to a login page.

Sitecore's built in handling of this is fairly black and white. It the content user doesn't have item:read permissions, then you are redirected to the login page, or presented the noaccess.aspx page, if you don't have login url set in the site definition.

For the sake of an example, if the item has the extranet/everyone inheritance permission denied, and a specific extranet role granted. This restricts the page appropriately.

Because the access is blocked at the 'page level' no amount of SecurityDisabler() within controllers or renderings makes any difference.

I don't want to use field level permissions, plus in the current scenario the same templates and fields are used for both public and restricted extranet roles.

Update: I don't want to redirect away from the page due to SEO requirements (nothing will be indexed for this page if it redirects anonymous users away) and from a UX perspective it is a better experience to remain on the page.

  • 1
    Could you possibly explain why you don't want anonymous users to be redirected to a login page? – Sergeant Sitecore Oct 24 '16 at 14:12
  • @SergeantSitecore Added detail why I don't want to redirect. – Paul George Oct 24 '16 at 15:37
7

You will need to use component personalization for this.
That means all users get access to the page, but on the personalization rules for components you set exceptions based on security.

For example:

enter image description here

Here is a walkthrough on how to set up component personalization: https://doc.sitecore.net/sitecore_experience_platform/digital_marketing/personalization/walkthrough_personalizing_components

  • Good idea. Because each page can have different role access, this would result in setting presentation data manually or programmatically for each individual page. For 1000+ pages which otherwise have the same presentation, this doesn't sit comfortably with a long-term view. – Paul George Oct 25 '16 at 20:36
2

Based on your description, I would assume that you have a page that contains a significant amount of content that is visible to anonymous users (and search engines) but you also want to be able to have additional content that is displayed if the user is authenticated.

Differentiate Between URL Security and Content Security

Given the above scenario, the Sitecore.Context.Item should be visible to anonymous users. The datasource Item of any Renderings that would render restricted content should be secured such that it cannot be accessed by users that are not authenticated. This may mean moving restricted content off of your page Item, but it's probably the easiest scenario to support.

Separating access to the page from access to content displayed on the page allows you to place your login form anywhere you want. In many sites where content is heavily mixed like this, the login form is frequently placed as a static component of your page header, allowing all pages to be login pages.

Build Renderings so that They Only Display if Datasource != null

For renderings that might be supplying restricted content, create a base rendering class (or a base controller class) that outputs nothing if the Datasource Item resolves to null.

For WebForms Rendering

public class MyRendering : Sitecore.Web.Ui.WebControl
{
  protected void Page_Load(object sender, EventArgs e)
  {
    if (this.GetItem == null)
    {
      this.Visible = false;
    }
  }
}

For WebForms Sublayouts

public class MySublayout : UserControl
{
  protected void Page_Load(object sender, EventArgs e)
  {
    var sublayout = Parent as Sublayout;

    // This assumes DataSource is an ID
    var item = Sitecore.Context.Database.GetItem(sublayout.DataSource);

    if (item == null)
    {
      this.Visible = false;
    }
  }
}

For Controllers

public ActionResult Index()
{
  if (RenderingContext.Current.Rendering.Item == null)
  {
    return new EmptyResult();
  }
}

Built-in Item security will ensure that secured content is not returned to your renderings unless the user is authenticated. Make sure to set your Vary by Data and Vary By User caching parameters!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.