6

I am looking into access viewer in Sitecore. My goal is to restrict certain users with just read-only access to core and web database. However these users need to have a write access to some items in the master database.

For this, I have created a new role and I plan to add those users to this specific role. However the problem arises when I try to set access rights, I do not see a distinction between the databases and I am thinking it will probably apply those permissions to all the databases. Hence I am not able to figure out a way to restrict core and web to read-only but master to read-write.

I was also wondering, if read-only access is not possible, can I deny the access to core and web databases entirely? I found this link: https://community.sitecore.net/developers/f/8/t/433 but it looks like this will only hide the databases in the tray icons and users would be still able to reach the databases by tweaking the url.

So, my question is : Is there a way to restrict read-only access to core and web databases. If not, is there a way to completely deny access to these databases for certain groups while setting different access rights for master database for those exact users.

Please let me know!

Thanks!

2

Aha, found a way to do this:

So looks like the important piece of functionality that I was unaware about, is that the Access Viewer only treats the permissions for the current database. So to set different permissions to different databases, I need to first switch a database, open the access viewer again and then set necessary permissions for the items in that database.

This also would explain why there is no "Database Selector / Switcher" which I was expecting inside Access Viewer.

To summarize, these are the steps that I followed:

1) Login as Admin.
2) Create a new role that I want to apply restrictions for.
3) Add all the necessary users to that particular role.
4) Open Access Viewer and assign appropriate permissions for that role.
5) Switch database either by using desktop view or url.
6) Repeat step 4 and 5 for all the required databases.

In my case, when I set up the permissions to the core database, 'database selector' disappeared from the sitecore tray in desktop view (which is already a good sign) and when I tweaked url to open core database, I did get a read-only view as I expected.

For reference, here is the screenshot of 'read-only' core database:

Read only core database



UPDATE:

This approach works well for core database. However for web database, since publishing can overwrite permissions, you would have to take some extra measures such as preventing publishing for certain items etc.

  • 1
    I would be careful about this. Permissions are stored directly on items so I believe your idea works fine for the core database however if you are setting different permissions on a web item than what is in master then a publish will overwrite the permissions you set in web with what you have in master. – Teeknow Jul 13 '17 at 15:59
  • @teeknow - Yes, you are probably correct. For now I have set different permissions on web and master but I sure have to do a lot of testing :). I have also heard about publishing overwriting access rights. In that case, I would need to figure out something. Or I guess I can restrict publishing for those specific items. Thanks for the input though! – Akshay Mahajan Jul 13 '17 at 16:03
  • 1
    Great sounds like a plan. After making those publish permission restrictions, a big test case would be publishing the entire site. I'm not positive what happens if a content editor has the ability to publish the whole site (screencast.com/t/K40IbeNjdn) but does not have access to publish certain items directly. If the publish site button publishes items the content editor doesn't have access to publish directly you may need to look into getting the publishing pipeline to skip certain items. – Teeknow Jul 13 '17 at 16:56
  • 1
    I agree, that is a good test case! Thanks again for that :) – Akshay Mahajan Jul 13 '17 at 17:02
2

Your idea works but in the case where an admin publishes the entire site. If that happens then the permissions set in master will clobber the permissions set in web (or any other dbs that are being published to). Assuming you are setting these permissions on items that content editors will never need to edit (i.e. the item /sitecore) the following processor should allow for a way to avoid this issue:

Processor:

using Sitecore.Diagnostics;
using Sitecore.Publishing;
using Sitecore.Publishing.Pipelines.PublishItem;
using System.Linq;

namespace MyNamespace.Sitecore.Pipelines
{
    public class SkipItemsProcessor : PublishItemProcessor
    {
        public override void Process(PublishItemContext context)
        {
            Assert.ArgumentNotNull((object)context, "context");

            var idsToSkip = global::Sitecore.Configuration.Settings.GetSetting("Publishing.ItemsToSkip", string.Empty).Split('|');
            if (!idsToSkip.Contains(context.ItemId.ToString()))
                return;

            context.AbortPipeline(PublishOperation.Skipped, PublishChildAction.Allow, string.Empty, true);
        }
    }
}

Patch file:

<?xml version="1.0"?>
<configuration xmlns:patch="http://www.sitecore.net/xmlconfig/">
  <sitecore>
    <settings>
      <setting name="Publishing.ItemsToSkip" value="_Insert list of ids to skip_" />
    </settings>
    <pipelines>
      <publishItem>
        <processor type="MyNamespace.Sitecore.Pipelines.SkipItemsProcessor, MyDll" 
                   patch:after="*[@type='Sitecore.Publishing.Pipelines.PublishItem.CheckSecurity, Sitecore.Kernel']" />
      </publishItem>
    </pipelines>
  </sitecore>
</configuration>

It's definitely worth noting that this should be used very sparingly. It will essentially disable publishing for the chosen item(s) which can cause troubleshooting nightmares if abused. This has not been thoroughly tested.

  • I believe skipping publishing may not be desired in this state and we may have to just accept the fact that the permissions would get copied over from master to web when published. However, your solution works great if the items are intended not to be touched. Kudos for the effort you took to answer this! – Akshay Mahajan Jul 13 '17 at 18:31
  • Alright fair enough. This would be something to use if you were applying a permission to the item /sitecore in web. – Teeknow Jul 13 '17 at 19:31
  • Sure!! That is correct! – Akshay Mahajan Jul 13 '17 at 19:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.