0

I am working on SPE code to set user permissions for a specific tree item.

$role = "Michael"
$path = "master:\content\home\distributors\a-b\Austria"
$acl1 = New-ItemAcl -AccessRight item:read -PropagationType Any -SecurityPermission AllowAccess -Identity $role
$acl2 = New-ItemAcl -AccessRight item:write -PropagationType Any -SecurityPermission AllowAccess -Identity $role
$acl3 = New-ItemAcl -AccessRight item:rename -PropagationType Descendants -SecurityPermission AllowAccess -Identity $role
$acl3a = New-ItemAcl -AccessRight item:rename -PropagationType Entity -SecurityPermission DenyAccess -Identity $role
$acl4 = New-ItemAcl -AccessRight item:create -PropagationType Any -SecurityPermission AllowAccess -Identity $role
$acl5 = New-ItemAcl -AccessRight item:delete -PropagationType Descendants -SecurityPermission AllowAccess -Identity $role
$acl5a = New-ItemAcl -AccessRight item:delete -PropagationType Entity -SecurityPermission DenyAccess -Identity $role
$acl6 = New-ItemAcl -AccessRight item:read -PropagationType Descendants -SecurityPermission AllowInheritance -Identity $role
Get-Item -Path $path | Add-ItemAcl -AccessRules $acl1, $acl2, $acl3, $acl3a, $acl4, $acl5, $acl5a, $acl6 -PassThru

This is working to set the item and descendants for read, write, rename, create, and delete. I can't figure out how to also set the inheritance option for item and descendants though.

It doesn't seem I can do item:inheritance under -AccessRight.

When I try doing: New-ItemAcl -AccessRight item:read -PropagationType Descendants -SecurityPermission AllowInheritance -Identity $role it doesn't do anything.

Any thoughts on this?

assign security rights

1 Answer 1

2

As seen in the official docs you should be assigning the output from New-ItemAcl to a variable and then using Set-ItemAcl to assign to an item; alone it won't change anything on the item.

Note: Add-ItemAcl works with the existing access controls on the item. Set-ItemAcl overwrites with whatever you provide.

From the example here you can see the following:

$acl1 = New-ItemAcl -AccessRight item:delete -PropagationType Any -SecurityPermission AllowAccess -Identity "sitecore\adam"
$acl2 = New-ItemAcl -AccessRight item:read -PropagationType Descendants -SecurityPermission DenyAccess -Identity "sitecore\mikey"
Get-Item -Path master:\content\home | Set-ItemAcl -AccessRules $acl1, $acl2 -PassThru

Let's say I want to set the inheritance on the item like in the following image:

Example

$item = Get-Item -Path "master:" -ID "{110D559F-DEA5-42EA-9C1C-8A5DF7E70EF9}"

$aclEntity = New-ItemAcl -Identity "sitecore\Developer" -AccessRight "*" -PropagationType Entity -SecurityPermission AllowInheritance
$aclDescendants = New-ItemAcl -Identity "sitecore\Developer" -AccessRight "*" -PropagationType Descendants -SecurityPermission AllowInheritance 
$item | Set-ItemAcl -AccessRules $aclEntity,$aclDescendants -PassThru

Combining our two scripts you can achieve this:

Final

$item = Get-Item -Path "master:" -ID "{110D559F-DEA5-42EA-9C1C-8A5DF7E70EF9}"

$role = "sitecore\Developer"

$acl1 = New-ItemAcl -AccessRight item:read -PropagationType Any -SecurityPermission AllowAccess -Identity $role
$acl2 = New-ItemAcl -AccessRight item:write -PropagationType Any -SecurityPermission AllowAccess -Identity $role
$acl3 = New-ItemAcl -AccessRight item:rename -PropagationType Descendants -SecurityPermission AllowAccess -Identity $role
$acl3a = New-ItemAcl -AccessRight item:rename -PropagationType Entity -SecurityPermission DenyAccess -Identity $role
$acl4 = New-ItemAcl -AccessRight item:create -PropagationType Any -SecurityPermission AllowAccess -Identity $role
$acl5 = New-ItemAcl -AccessRight item:delete -PropagationType Descendants -SecurityPermission AllowAccess -Identity $role
$acl5a = New-ItemAcl -AccessRight item:delete -PropagationType Entity -SecurityPermission DenyAccess -Identity $role
$acl6 = New-ItemAcl -AccessRight item:read -PropagationType Descendants -SecurityPermission AllowInheritance -Identity $role

$aclEntity = New-ItemAcl -Identity $role -AccessRight "*" -PropagationType Entity -SecurityPermission AllowInheritance
$aclDescendants = New-ItemAcl -Identity $role -AccessRight "*" -PropagationType Descendants -SecurityPermission AllowInheritance 
$item | Set-ItemAcl -AccessRules $acl1, $acl2, $acl3, $acl3a, $acl4, $acl5, $acl5a, $acl6, $aclEntity, $aclDescendants -PassThru
1
  • Thanks Michael! that was a great answer and great description. Thank you for your help. Aug 5, 2022 at 13:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.