How to create multiple Sitecore Security Domain

Question

We want to create multiple Sitecore security domains for different groups and their users. Can you advice as how to achieve this?

Answer 1

You can use the Domain Manager within Sitecore to create new security domains. From the Sitecore Desktop:

Start > Security Tools > Domain Manager

From there, you can setup your Sitecore Roles specifing your new domains, then assign users to the Domain Role.

Answer 2

Editing the domains through the Domain Manager tool will cause \App_Config\Security\Domains.config to be updated with the added details. If you are updating this tool then make sure you include this in your project or copy it across to the other environments.

Unfortunately, the domains node is not patchable with Sitecore config overrides since it sits outside the <sitecore> node. You can however use a different domainManager which will use config and allow your domains to be patched like any other Sitecore config section.

<configuration xmlns:patch="http://www.sitecore.net/xmlconfig/">
    <sitecore>
        <domainManager defaultProvider="file">
            <patch:attribute name="defaultProvider">config</patch:attribute>
        </domainManager>
    </sitecore>
</configuration>

You can then patch in whatever domains you want:

<configuration xmlns:patch="http://www.sitecore.net/xmlconfig/">
    <sitecore>
        <domainManager>
            <domains>
                <domain id="MyCustomNewDomain1" type="Sitecore.Security.Domains.Domain, Sitecore.Kernel">
                    <param desc="name">$(id)</param>
                    <ensureAnonymousUser>false</ensureAnonymousUser>
                </domain>
                <domain id="MyCustomNewDomain2" type="Sitecore.Security.Domains.Domain, Sitecore.Kernel">
                    <param desc="name">$(id)</param>
                    <ensureAnonymousUser>false</ensureAnonymousUser>
                </domain>
            </domains>
        </domainManager>
    </sitecore>
</configuration>

You can read more about this in Configuring domains from patch files post by Kam Figy.