Is it possible to assign the ability to unlock multiple users' items to a non-administrator role?

Question

One of the things I have to occasionally do as an administrator is unlock items which a user has forgotten to unlock before leaving on vacation. I've been asked if we could create a role which could perform this function (in order to back me up in this area), but which does not have other admin level functions, e.g. user administration.

I've been looking, but not been able to find a way to assign this specific function to a role. Is this possible?

Thanks for your help!

Answer 1

Delegated Administration with SPE

Let's say for example that you wanted to provide a Context Menu option for users to unlock items based on the following criteria.

• Show when User is in the sitecore\Delegated Admin role
• Enable when the item is locked

In between cooking eggs at home I was able to whip this up.

So here is how I built it.

1. Create a new SPE Module with a Context Menu library.
2. Create a new script for unlocking the selected item.
3. Configure a rule for Show and Enable when certain conditions are met.

Now the user is able to Lock and Edit.

Sample script for Unlock Elevated:

$item = Get-Item -Path .
# The user should be one granted the appropriate access.
$user = Get-User -Id "superuser"
New-UsingBlock (New-Object Sitecore.Security.Accounts.UserSwitcher $user) {
    $item | Unlock-Item
}

Note: This solution may be better suited as a Ribbon command. You can read more about how to do that here.

---

Turns out Richard Seal apparently had the same idea today and hosted this.

Answer 2

Assuming you're only interested in shell behaviour, there's a long and a short answer.

Short answer: no. The command that executes this functionality (Sitecore.Shell.Framework.Commands.CheckIn) only allows the unlock action to happen if the user is an administrator or if the user owns the lock. This is regardless of permissions you set on the button item.

Longer answer: yes. But you need to write your own command to do the unlock. This is actually quite straight-forward. You create a new command, register it in configuration, and then replace the command name on the item with your own (or add an extra button).

What you do in your command will depend on your Sitecore version. Offhand, I don't know when the change came in, but I think that the same check present in the command used to be present in the item.Locking.Unlock() method. If this doesn't work for you, you can cheat a bit and directly call ReleaseLock() on the lock field (which you can get by using (LockField)item.Fields[FieldIDs.Lock]).

You should make sure that your command performs the necessary security checks for your application; as you probably don't want it to be available to everyone.

Answer 3

Unfortunately, I do not believe there is a permission/role that can be assigned to a user to give them this ability. It is build into the special "admin" user.

However, you could write a script using Sitecore PowerShell Extensions (SPE) that does this, and give specific users access to run it via a custom button. You could do this by either creating a button that executes a script to unlock all items for all users, all items for the current user, open a SPEAK dialog where the user can select a specific item from the tree to unlock, a specific user to unlock all items for, or for the currently selected item in the content editor. Here are the docs for the Unlock-item SPE call.

Alternatively, you could also write a custom SPEAK tool for unlocking items using C#. In either scenario, you would selectively give users/roles Read access to the custom button(s) that open(s) or execute(s) the tool.

It is worth noting that either option involves you creating a custom button to run your tool, and any user that you give access see the custom button will have access to use the tool.