Creating a Custom Sitecore Admin Page to Create a Report

Question

I would like to add a new admin page that will only be available to users logged into the Sitecore admin.

I guess the page is supposed to inherit from Sitecore.sitecore.admin.AdminPage.

And, then call the CheckSecurity method:

protected override void OnInit(EventArgs e)
{
    this.CheckSecurity(false);
    base.OnInit(e);
}

Is this basically all I need to know to get this to work?

Answer 1

The boolean for the CheckSecurity method will specify whether or not to allow users of the Developer role access (or not). If 'false' (as shown) only admin users can get through.

I also recommend that you place this physically inside the /sitecore/admin folder to take advantage of any hardening you might have configured on your servers to prevent access to the admin pages.

If you choose to do in another location, you should make sure that the same hardening rules are applied to your custom location.

Answer 2

This should be pretty much all you need, less the ASPX that inherits that class, and with the added caveat that this solution will only work for users that are either administrators or have the 'Developer' role. Note that you will likely still want to follow the Security Hardening best practices and move your "admin page" into the <webroot>/sitecore/admin folder, as described in greater detail, at the end of this post.

Based on your updated question, it sounds like you are now looking for an admin page that all users can log into, so I'm not sure if the solution that you mentioned is actually the solution that you are looking for.

UPDATE: Based on your latest updates, you are now passing false to the CheckSecurity(...) method which tells the page to only allow administrators to log into the page, whether or not they are members of the 'Developer' role. I have included a screenshot of the defintion of this method and its overload, below. Again, I'm not sure that this is what you are looking for, based on the wording of your question.

What the Sitecore.sitecore.admin.AdminPage does

What your solution will do is make the page "gated", i.e. one will have to be a user that is either an administrator or a member of the "Developer" role (if you pass true to the CheckSecurity() method) in order to access the page.

For reference, here is the code for the CheckSecurity method (and its overload) in the Sitecore.sitecore.admin.AdminPage class:

Your ASPX file should include a typical page directive that inherits the class that you created that inherits Sitecore.sitecore.admin.AdminPage. The directive would look something like the following:

<%@ Page Inherits="MyNamespace.MyClass" ... %>

What I think you are looking for...

Based on the wording of your question, what I think you are looking to do is create a page that is accessible via login for all users with access to log into the Sitecore Client. If this is the case, you can always mimic what Sitecore does with Sitecore.sitecore.admin.AdminPage by creating your own backing class with a custom CheckSecurity method that allows all enabled users that are members of the sitecore security domain.

You can do this by creating a class similar to the following:

  public class GatedToolPage : Page
  {    
    protected void CheckSecurity()
    {
      if (Context.User.Domain == "sitecore")
        return;
      SiteContext site = Context.Site;
      if (site == null)
        return;
      this.Response.Redirect(string.Format("{0}?returnUrl={1}", (object) site.LoginPage, (object) HttpUtility.UrlEncode(this.Request.Url.PathAndQuery)));
    }

    protected override void OnPreRender(EventArgs e)
    {
      base.OnPreRender(e);
      this.Response.AddHeader("X-Frame-Options", "SAMEORIGIN");
    }
  }

You would then have all of your custom admin pages that should be accessible to all users with a valid Sitecore Client login inherit this new class.

Security Hardening

The only thing that remains is that you will likely want to put this ASPX page in your <webroot>/sitecore/admin folder. I would do this regardless of whether you use the OOTB AdminPage class or write your own.

It is a Sitecore securities "best practice" to put custom admin pages in your <webroot>/sitecore/admin folder. This will enable you to control the access-control restrictions for the new admin page at the folder level, giving this page the same access-control restrictions as the other pages in the same folder.

The above security step will save you time, effort, and ensures that the instructions in the security hardening guides are still applicable to ALL admin pages, including your custom ones.