Assign Sitecore roles to users in custom domain

Question

I have created a role under the Sitecore domain, with the following Sitecore roles inheriting:

1. Sitecore client authoring
2. Sitecore Client Advanced Publishing
3. Sitecore Client Developing
4. Sitecore Client Publishing
5. Sitecore Client Securing
6. Sitecore Local Administrators
7. Sitecore Client Account Managing

The above role is working fine with the user under "sitecore" domain, but when the same role is used for a user under the custom domain (newly Created) following permission are getting disabled:

1. Workflow Access to the "Awaiting Approval" State, that is access to the "Approve" and "Reject" commands. Although, only the draft state is accessible.
2. Access the Security tab on the Sitecore ribbon.
3. Delete access to any item from the content editor. (But the user is supposed to delete items in any state).

If there is something I am missing to configure, please let me know. Thanks in advance.

Answer 1

In Sitecore, when you assign access rights to items, they always inherit the access right that is assigned to their parent item in the content tree. However, if you need to, you can overrule the inherited rights on an item by assigning access rights specifically on the item or denying the item the right to inherit.

Further details are available on : https://doc.sitecore.com/xp/en/developers/93/platform-administration-and-architecture/assigning-access-rights.html

Also, you can view permission for items and you can troubleshoot permission applied to the item by adjusting the applied permission on the right side in the Access Viewer window.

Answer 2

I think you should edit your domain and clear the Locally Managed Domain check box.

In a locally managed domain, the users and roles are domain-specific and the users can only see the items in the domain that they belong to and not the other domains in the system.

To edit a domain:

1. Open the Domain Manager and click the domain that you want to edit.

2. In the Domains group, click Edit.

3. In the Edit Domain dialog box, select or clear the Locally Managed Domain check box.

Alternatively, A security account can only be assigned to one domain. If, for example, a user needs to access multiple domains, you must create separate roles for each domain that they need to access and make the user a member of all the relevant roles.

Follow this article for more details.

https://doc.sitecore.com/xp/en/developers/91/platform-administration-and-architecture/create-and-edit-a-security-domain.html#:~:text=Log%20in%20to%20Sitecore%2C%20and,Click%20OK.