2

I have sitecore setup with 30 + site nodes ( site-Australia, site-Germany, site-Japan ,site-US etc.) in Sitecore. At present all editors and publishers have access to all of these nodes which in practical not an ideal design.

We want to restrict the access to editors and publishers in such a way that , Australia editor can not edit or see the Germany site node items, similarly US editor can not see or edit items in Australia or German (or any other) site nodes.

As a solution, I created region wise editors and publishers ( Auseditor, Japaneditor ) and allowed read,write, create, rename and inheritance access to that region node and denyed the write access to other nodes. This works fine with individual editors.

Now issue I am facing is , there are editors who need access to 2 or more regions (for eg. ASIA editor who needs access to Australia, Japan nodes) and in that case, since the deny takes the priority over grant, when I add both the roles, that editor is not able to write the content as Japan node denies write access to Australia node and Australia editor role denies the write access to Japan.

The solution I thought for this is to create another role for such "combined" editor roles and give the write access to these multiple nodes. But not sure this is right approach for access rights for multi node solution as we have many nodes and I suspect that we may end up managing such "combined" scenarios as and when required in future which may make the role management tedious and cumbersome. So looking for some simplistic solution thoughts for this design.

If you have come across the situation and have better suggestion/solution please do share.

4
  • Are you managing your Sites using SXA? Oct 10, 2022 at 7:19
  • 1
    Never use DENY unless you're really sure you want this. Read this series of blog posts about Sitecore security and use inheritance (and breaking inheritance) properly: constellation4sitecore.com/2019/06/25/…
    – Marek Musielak
    Oct 10, 2022 at 7:21
  • @SumitBhatia : No , Not managing site using SXA Oct 10, 2022 at 7:23
  • Please help Gatogordo, I have an isssue with Search Query Resolver, it’s not working, it’s not showing up in SXA search scope Oct 13, 2022 at 6:07

1 Answer 1

0

As Marek mentioned you should not use the deny to block access to the other site nodes. If you use the inheritance feature as described on https://doc.sitecore.com/xp/en/developers/102/platform-administration-and-architecture/the-inheritance-access-right.html you will get the same result - editors not being able to see/edit the sites they shouldn't see but you will be able to give certain editors 2 or more roles and enable them this way to edit multiple site nodes as there is no deny anymore that blocks the grants.

4
  • Hi Gatogordo, I went through the articles you and Marek shared , and applied it to two nodes but I still see the same issue. I created two roles - Indeditor and Auseditor .. I have two site nodes site-India and Site-Australia both are under content. (content/site-india and content/site-australia). This time , I gave read, write, create and rename rights to content item. For indeditor , I deny the inheritance rights for australia node and for auseditor I deny the inheritance rights to India node. So when the user with both the roles logs in ,it can not see any of the nodes due to conflict Oct 10, 2022 at 10:08
  • as per the conflict of rights, : If a user is a member of two roles, one that allows the user to inherit an access right to an item and another that does not allow the user to inherit the same access right to the item, then the user is denied the access right. Oct 10, 2022 at 10:09
  • I have fixed this by creating another role and grant the access to both australia and india site nodes. This resolved my issue Oct 10, 2022 at 10:54
  • It should work if you break the inheritance and then grant the needed access right (read/edit/...).
    – Gatogordo
    Oct 10, 2022 at 11:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.