7

Background

We have an upcoming multi-site project, in which our client would like us to implement a "restricted" SSO wherein the users of mainsite.com that have been given access to employees.mainsite.com will only have to log into one of the two sites to be logged into both. Note that all users must first become members of mainsite.com before they can be given access to employees.mainsite.com.

Most of the SSO has been worked out, and I am planning to use the same domain for users of both sites. Since all users would be created on mainsite.com first, I would simply use a security Role on the employees domain to allow access to the employees.mainsite.com.


Question

I know that I can assign roles from different domains to a user, but are there any negatives of doing this? Also, if a user with a given role is meant to have access to a site with a different security domain, are there any special security or configuration concerns that I should be aware of?

Improve this question
1
  • I will need to verify this, hence the comment, and not an answer, but I believe that you will want users and roles to be in the same domain. If your user for both sites is in the mainsite domain, then your role to restrict access to employees.mainsite.com should also be in the mainsite domain. Both site definitions will need to be in the same domain as well. Again, I need to double check this, but I believe it's correct.
    – Pete Navarra
    Dec 2 '16 at 21:01
4

Admittedly I'm not entirely sure what you're aiming for, but some general points that may be relevant:

Administration within a sitecore security domain.

If you want to allow each domain to administer itself without being able to interact with other domain roles, you may need them to be separate. If using locally managed domains, An admin of a domain can manage users within that domain only and assign roles from that domain. They can't see roles or users from other domains.

Global roles

Global roles are useful when you want an a role that is visible to all security domains. They are defined in \App_Config\Security\GlobalRoles.config. If you are carefully limiting roles that can be assigned within a domain, something you may want to do is to remove the default global roles so that only the roles you create within a domain are visible.

I know that I can assign roles from different domains to a user, but are there any negatives of doing this?

If using locally managed domains I think only a real admin can do this, unless the roles are defined as Global Roles. If you want to safely delegate role assignments to user admins, then you either need to make the global roles or use roles within each domain.

Improve this answer
6
  • I like the info and I think it will be helpful for others, but I'm not seeing how it really relates to the issue of deciding which domain(s) to use for the sites or which domain(s) should have the role(s) that grant access to one site or the other in a situation where you have multiple sites running Single-Sign On. Can you try to relate the information in your post back to that issue and detail the pros and cons of the conclusion(s) that can thus be drawn?
    – Zachary Kniebel
    Dec 9 '16 at 16:49
  • I've expanded a little but I don't know enough about what you want to achieve or avoid. Perhaps add some specific outcomes you want in the question.
    – Paul George
    Dec 9 '16 at 17:28
  • I think I may see the confusion, here. The question isn't about admins assigning roles to users. The question is in regards to the negatives of using a role on a different domain than the users belong to in order to give them access to the subdomain site at an architectural level. From your response, I think you may have provided a potential answer (one it doesn't sould like you have confirmed yet) which was that one negative is that our client "admins" would have to be real "admins" to grant users access via a role on a different domain.
    – Zachary Kniebel
    Dec 9 '16 at 17:37
  • I am pretty sure that isn't the case, though. Have you verified that?
    – Zachary Kniebel
    Dec 9 '16 at 17:37
  • I believe I was thinking of 'locally managed' security domains, which can't see outside of themselves - users or roles.
    – Paul George
    Dec 9 '16 at 17:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.