We're using Sitecore authentication with a custom membership/roles database that's hooked into Sitecore with its own domain. We imported a ton of legacy data, and due to the number of documents, we put what normally would go in the media library into a folder in the Windows tree for the site, so they're accessible. We need to secure these now.

Is there a way to do this without having to import the lot into Sitecore? Like, using impersonation somehow to do it? Or is it better to bite the bullet and bring them all into Sitecore?

  • Are you using file-based media items? You could always use Sitecore PowerShell Extensions to generate those items in the media library based on the files you have on disk. Jan 7, 2017 at 20:43
  • Can you clarify what exactly are you trying to achieve? Jan 7, 2017 at 20:52
  • We're using database-based media items, these are just legacy items that at the time we thought was too much/too long to import. Basically, some of these items need to be accessible only if logged into Sitecore authentication, so I'm trying to find a way to use that authentication against a Windows/IIS folder if possible. Jan 7, 2017 at 22:02
  • 1
    As well as SPE, there are some other easy options to easily import the documents into the media library: jammykam.wordpress.com/2016/03/11/mass-uploading-media
    – jammykam
    Jan 8, 2017 at 9:23

1 Answer 1


Sometimes the simple answers are the best. I changed the authentication method in the web.config from "None" to "Forms" - this apparently no longer keeps you out of the shell like it used to. Then I put an authorization for the site in general, and another for the location to protect:

        <!--Switching to Forms authentication to enable blocking subfolders-->
    <authentication mode="Forms" xdt:Transform="SetAttributes">
        <forms timeout="120" slidingExpiration="true" xdt:Transform="SetAttributes" />
    This allows all users onto the site but is needed for the location setting to deny subfolder access;
    Sitecore authentication still prevents users from accessing the members site without a login
    <authorization xdt:Transform="Insert">
        <allow users="*"/>

<location path="Attachments" xdt:Transform="Insert">
            <deny users="?"/>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.