Securing a page with item permissions without redirecting the user away

Question

Is it possible to set restrictive extranet group permissions on a page-level item, and still have that page render, albeit differently, to users without the correct permission i.e. present a call to action. I don't want to redirect the user away to a login page.

Sitecore's built in handling of this is fairly black and white. It the content user doesn't have item:read permissions, then you are redirected to the login page, or presented the noaccess.aspx page, if you don't have login url set in the site definition.

For the sake of an example, if the item has the extranet/everyone inheritance permission denied, and a specific extranet role granted. This restricts the page appropriately.

Because the access is blocked at the 'page level' no amount of SecurityDisabler() within controllers or renderings makes any difference.

I don't want to use field level permissions, plus in the current scenario the same templates and fields are used for both public and restricted extranet roles.

Update: I don't want to redirect away from the page due to SEO requirements (nothing will be indexed for this page if it redirects anonymous users away) and from a UX perspective it is a better experience to remain on the page.

Answer 1

You will need to use component personalization for this.
That means all users get access to the page, but on the personalization rules for components you set exceptions based on security.

For example:

Here is a walkthrough on how to set up component personalization: https://doc.sitecore.net/sitecore_experience_platform/digital_marketing/personalization/walkthrough_personalizing_components

Answer 2

Based on your description, I would assume that you have a page that contains a significant amount of content that is visible to anonymous users (and search engines) but you also want to be able to have additional content that is displayed if the user is authenticated.

Differentiate Between URL Security and Content Security

Given the above scenario, the Sitecore.Context.Item should be visible to anonymous users. The datasource Item of any Renderings that would render restricted content should be secured such that it cannot be accessed by users that are not authenticated. This may mean moving restricted content off of your page Item, but it's probably the easiest scenario to support.

Separating access to the page from access to content displayed on the page allows you to place your login form anywhere you want. In many sites where content is heavily mixed like this, the login form is frequently placed as a static component of your page header, allowing all pages to be login pages.

Build Renderings so that They Only Display if Datasource != null

For renderings that might be supplying restricted content, create a base rendering class (or a base controller class) that outputs nothing if the Datasource Item resolves to null.

For WebForms Rendering

public class MyRendering : Sitecore.Web.Ui.WebControl
{
  protected void Page_Load(object sender, EventArgs e)
  {
    if (this.GetItem == null)
    {
      this.Visible = false;
    }
  }
}

For WebForms Sublayouts

public class MySublayout : UserControl
{
  protected void Page_Load(object sender, EventArgs e)
  {
    var sublayout = Parent as Sublayout;

    // This assumes DataSource is an ID
    var item = Sitecore.Context.Database.GetItem(sublayout.DataSource);

    if (item == null)
    {
      this.Visible = false;
    }
  }
}

For Controllers

public ActionResult Index()
{
  if (RenderingContext.Current.Rendering.Item == null)
  {
    return new EmptyResult();
  }
}

Built-in Item security will ensure that secured content is not returned to your renderings unless the user is authenticated. Make sure to set your Vary by Data and Vary By User caching parameters!