What access in security editor should i give when i want a role to have login capability.

I want to create a new role that is NOT a member of any other existing roles (like client author or Author or anything)

But i want to customize that role, so that the user can LOG IN and see some content items.

For now i created some sample role and gave read access to the entire sitecore content tree - like

content, templates, layouts and Media

but when some with that role tries to log in - sitecore doesn't allow to log him in. It says

You do not have access to the system. If you think this is wrong, please contact the system administrator.

Should i be doing anything in core database also?

1 Answer 1


You actually answered the first part of your question in your comment on this post, while responding to my incorrect suggestion that the user should be a member of the sitecore domain to access Sitecore. I have updated my answer with the correct information and my recommendations for your needs, below.

Adding Access to the Sitecore Client

The Sitecore Client Users role is all that is required in order to have access to Sitecore. Being a member of the sitecore domain is actually not required.

According to Sitecore's documentation, the Sitecore Client Users role adds the following:

Gives the user minimal access to Sitecore. With this role, the user can log in to the Sitecore Desktop, but will not have access to any applications.

This means that so long as you add the Sitecore Client Users role to a user, said user should be able to log into Sitecore but will not have access to any of the applications.

Adding in Access to the Content Editor

The next step is to give your user access to the Content Editor. I recommend adding the Sitecore Limited Content Editor role, as it grants access to the Content Editor with the minimum rights granted. Note that if you add this role to your users, you don't actually need to add the Sitecore Client Users role, since it is included in the Sitecore Limited Content Editor role, as well.

Per Sitecore's documentation, the Sitecore Limited Content Editor role does the following:

When a content author is assigned this role, they only have access to the Home, Review, and Publish tabs on the Content Editor ribbon and have no access to copy, move, or sort from the item's right-click menu.

Adding Ability to Read Specific Items

Lastly, you should create an extra role that has read access to the items that your limited users should be able to read. Give that role to your users, as well, as the Sitecore Limited Content Editor role and your should be good to go.

Remember that for your content authors to be able to read an item, they should be able to read that item and its ancestors. The only exception to this is if you have the ContentEditor.CheckSecurityOnTreeNodes setting set to false. If so, then your authors will be able to see but not click on items in the tree that they do not have access to. See this post for more details on the ContentEditor.CheckSecurityOnTreeNodes setting.

  • hey @Zachary - the user is in sitecore domain - if i add Sitecore\clientusers to that user he is able to login in. but if remove that and just add sitecore\newrole he is not able to log in Sep 12, 2017 at 16:09
  • Sorry about that, @NightMonger. You are totally right - the Sitecore Client Users role is all that is required. Being a member of the sitecore domain is not. I have updated my post accordingly. Sep 12, 2017 at 16:16
  • Is there a way i DONOT give client users but create a role equivalent of that and select my own set of items? this is in turn connected to my previous question you answered about giving specific access to item. by default client user has read for all. i need to manually revoke for each item which i dont want to do. Sep 12, 2017 at 16:36
  • While you are right that the user with client access will not have access to any application, he will but have access to all the pages - so basically he can log in and in the same window type mywebsite.com/my-locked-page and he is able to view that Sep 12, 2017 at 16:41
  • The sitecore\Sitecore Client Users role does not have read access to any content items, by default. However, as a member of the sitecore domain, it does have the sitecore\Everyone role and the Everyone role included with it, and those roles do have read access to content items. Without the sitecore\Sitecore Client Users role, your users cannot log into Sitecore and there is no way around that AFAIK. Sep 12, 2017 at 16:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.