Deny Read Access in "shell" but allow Read Access on the front end

Question

I have a Sitecore site that has a section of region pages. I need to create roles for sites that will allow a user to only see their assigned region in the shell. This role should not keep the user from being able to see other regions on the front end though.

Is there a way to separate read access in the shell vs read access on the front end of the site? The site is going to be accessible to anonymous users. The goal of this is to allow a content editor that only has permission to edit a region to still be able to look at the front end of any other region on the site without needing to log out of the shell. I have discussed just not allowing write access to other regions however a requirement is that regions cannot see unpublished data another region has.

Answer 1

The security administration should be your friend in anything security related with Sitecore. You can access it here.

Based on your question there should not be any issues in setting up things the way you want BUT you are talking about two different domains: 1- sitecore domain which is the backend 2- extranet domain which is the frontend.

A security account can only be assigned to one domain. If, for example, a user needs to access multiple domains which seems to be your case, you must create separate roles for each domain that they need to access and make the user a member of all the relevant roles to have proper access. You can use the Role Manager to create your roles and the security editor to assign the permissions. With access viewer you can see the permissions for the roles so you can have a good way of seeing which permissions are being set.

Hope this helps

Answer 2

Sitecore uses domains for this purpose: https://doc.sitecore.net/sitecore_experience_platform/setting_up_and_maintaining/security_and_administration/users_roles_and_domains/security_domains

You can use security domains to manage user's access to different parts of Sitecore, for example, if you have multiple websites within a single system.

A Sitecore domain is a collection of security accounts (users and roles) that you can administer as a unit with common rules and procedures. A domain is used to collect security accounts that have some logical relationship, for example, all the accounts that have access to use the Sitecore clients could be stored in the Sitecore domain, whereas all the accounts with access to the published website could be stored in the Extranet domain.

So your users in the shell (Sitecore admin) will not be the same as the users used on the frontend - they will be in a different domain.

Mostly roles are not used over domains, although you should be able to mix roles and domains (and users), but if you would go that way it might become very complex - and probably still impossible for a single user to deny read access in the shell while having read access elsewhere (never mixed these myself).

Edit after comments: if you need a user to have different rights, you need 2 users (one in each domain). But if this is only to have your editors browse the site while editing, this can be achieved by using another browser or by using an incognito window in Chrome (anything that does not uses the same session actually).