Questions tagged [security]

Questions related to security in all it's aspects (as long as related to Sitecore). Can be Sitecore product security or security of your Sitecore application.

Filter by
Sorted by
Tagged with
6
votes
2answers
444 views

How to obtain a certificate from a certified authority for Sitecore 9 Installation?

I am planning to deployed Sitecore 9 Update 1 on Azure PaaS using Sitecore Marketplace template. I have created the non-production environment like SIT,QA,UAT using self signed certificate option and ...
7
votes
1answer
897 views

Edit after workflow approved

I just watched a tutorial on how to set up Workflows here: https://www.youtube.com/watch?v=hFDUgiQCTmU&list=PLfRWjEN_vCUZqAk8ks5j36yM-BCWup-SZ&index=1#t=35m58s I followed this tutorial ...
1
vote
1answer
78 views

Secured document I have permission to not showing in Coveo search

This is using Sitecore 8.1 Update 1, Coveo on-premises version 7 (8388.7) free edition, and Coveo for Sitecore version 4.0.222.0. I have a document that's been secured such that everyone is denied ...
10
votes
3answers
614 views

SQL user creation is setting password of 12345, fails deployment

Using the updated Sitecore Azure Toolkit 2.0.1 rev. 171218, which has resources for 9.0.1, I'm hitting an error on the xc-collect\MSDeploy stage where it's attempting to apply the default sql user ...
6
votes
1answer
343 views

How do I configure a custom security domain so that it doesn't need to be specified when logging in?

I have a custom security domain that has a majority of content authors in it. I feel like, there is a way, so that rather than optionally having to type in sitecore\user, you can make your custom ...
8
votes
3answers
373 views

How to change the domain of a custom role?

I have created some custom Roles under the "sitecore" domain, but now I want to migrate all the custom roles to another domain e.g. fancy_domain\Cool_Role. How to do it?
6
votes
1answer
458 views

Restricting access to particular page returns 404 instead of redirecting to login

I'm trying to restrict access to a particular page, I've already read everything possible on the matter but instead of redirecting to login page Sitecore is returning a 404. I've set the loginPage="/...
2
votes
1answer
74 views

Revoke read access to Sitecore page returns “Document not found” [duplicate]

I installed a vanilla Sitecore instance and revoked read access to the home page and published it. When I accessed the page I got "document not found" instead of access denied.
4
votes
2answers
257 views

Revoke read access to the home page doesn't work

I installed a vanilla Sitecore 8.2.5 instance and revoked read access on Home page to extranet/anonymous user. I logged out from the shell site and hit the home page and I am still able to access it ! ...
7
votes
3answers
582 views

Sitecore xDB Stale data encryption (always encrypted)

As Sitecore 9 is all about Data security, clear seperation and so on, we would obviously like to put those features to work. That is why we were wondering how the Stale data encryption that was ...
1
vote
1answer
199 views

how to add undefined language versions for an item in sitecore

I have a Sitecore user who is not an administrator. I want to add any language version of an item from more languages button available in the top right corner of an item even though that language is ...
4
votes
1answer
584 views

How to get connectionstrings for SQL and Redis from Azure Key Vault?

I am trying to understand if it is ever possible for Sitecore to load connection strings values from Azure Key Vault, not from web.config (or ConnectionStrings.config) file?
4
votes
1answer
981 views

How to implement forgot password feature in any Sitecore application

When a user forgets his password, he/she can click on forgot password link which will trigger an email with password reset link. How to implement this functionality in a Sitecore application? Since ...
4
votes
1answer
2k views

Sitecore client user login failed: You don't have access permission error

I installed sitecore 8.2 and after installation I logged in with admin account. Then i followed below procedure to create user and roles. 1) In the User manager I created one user - tom (not selected ...
2
votes
0answers
118 views

Application access denied - Custom Editor for Sitecore Client

I am building an editor for the Sitecore client. However when I load this editor in the content editor, it shows the error Application access denied. I am currently logged in as an administrator. ...
14
votes
2answers
394 views

Sitecore Trivia - Anyone know the story behind admin / b username/password?

Who originally picked admin / b username and password combo? Is there a story a behind it? Why b? I'm just curious if there is a story behind it.
2
votes
2answers
283 views

Encrypting Analytics Data in MongoDB

Does Sitecore support any options for encrypting analytics data stored in MongoDB? One of our clients wants to store personal information in xDB, but has required that we verify that the data can be ...
8
votes
1answer
738 views

Force Password Expiration

I used this before Sitecore 8 to force users to reset their passwords if they are past a certain date. I've been given this task again in Sitecore 8. It looks like the new change password page ...
3
votes
1answer
726 views

create custom role with login

What access in security editor should i give when i want a role to have login capability. I want to create a new role that is NOT a member of any other existing roles (like client author or Author ...
8
votes
3answers
2k views

Sitecore access to an Item based on role

I have a Sitecore application, and some of my content authors want to work on some "secret pages" that should not be available to anyone else, including other content authors. Only a few of the ...
1
vote
1answer
286 views

WFFM How to work-around error “Redirect item is null”

I am building registration pages for my site using WFFM. There are 4 steps in this process which I am handling with a separate form on a separate page. To prevent users being able to access the next ...
0
votes
0answers
116 views

Attempting to Change Template logs out user

On a site that was recently upgraded from v8.0 Update 3 to v8.1 Update 3, editors are reporting that when they attempt to change the template of an item, they end up on the login page. These users are ...
2
votes
1answer
554 views

How to enable 'Edit' ribbon button for non-admins

I want to enable 'Edit' button in the Sitecore ribbon. The problem is that this button is disabled for non-admins. Please note the following things which might help to better understand the issue: ...
6
votes
1answer
283 views

Setting up automated role creation for various SXA sites

The challenge I am trying to solve is to create dynamic roles for an SXA site, knowing that my client will be creating multiple SXA sites over time, and thinking that possibly the best way to ...
0
votes
1answer
280 views

FXM XMLHttpRequest cannot load

When connecting a website via the Sitecore Federated Experience Manager I was prompted to add a script to the destination site: <script src="//linkedwebsite.com/bundle/beacon"></script> ...
5
votes
1answer
273 views

Sitecore Log Viewer: Application access denied for all users including admin after upgrade

I'm getting a Sitecore.Exceptions.AccessDeniedException: Application access denied. exception when opening the Log Viewer, even though my user is Administrator. I have upgraded the project from 7.2 to ...
5
votes
2answers
402 views

How does one access a Security field programmatically?

Back in Sitecore 5 there used to be a class, Sitecore.SecurityModel.SecurityField. Seems like this class was removed in later versions. So, how does one access a Security field on an item now? ...
6
votes
2answers
832 views

Restricting certain users with read-only access to core and web database?

I am looking into access viewer in Sitecore. My goal is to restrict certain users with just read-only access to core and web database. However these users need to have a write access to some items in ...
11
votes
0answers
139 views

Parameter Template Security Oddity

I experienced a weird issue and was wondering if anyone has seen this. I had to lock down Templates and Renderings to be read only for content authors so a "Publish Related Items" would not publish ...
2
votes
2answers
143 views

Deny Read Access in “shell” but allow Read Access on the front end

I have a Sitecore site that has a section of region pages. I need to create roles for sites that will allow a user to only see their assigned region in the shell. This role should not keep the user ...
10
votes
2answers
4k views

Getting item from the Sitecore Item Service API not working remotely (403 Forbidden)

I was having an issue on a clients Staging environment where I was trying to use the Sitecore Item API to get items and I was getting an 403 error. It worked fine locally, I have a login method that ...
3
votes
2answers
367 views

Security Hardening: Folder Access Question

In the security hardening directions for 8.2 on denying anonymous access the screen shots all show having all access disabled for the /sitecore/admin folder and others. The question is, those screen ...
1
vote
1answer
80 views

SignUp and SignIn user using facebook

Need to sign up user using Facebook account without using Social Connector. I've created UserMembership with random password. But now how to signin this user? I mean complete AuthenticationManager....
4
votes
2answers
327 views

Securing Telerik on Sitecore 7.2

Telerik recently announced that there is a security vulnerability with all versions of Telerik.Web.UI.dll assembly prior to 2017.2.621. Sitecore includes documentation on how to secure Telerik for ...
1
vote
1answer
153 views

Security changes from 6.2 to 8.2

In the process of upgrading a site from 6.2 Update 1 to 8.2 Update 1, it appears the accounts of users are no longer able to log in. The client had a separate "security" database, which looks like a ...
6
votes
2answers
404 views

Restricting just a section of the page from editing

On one of my templates I need to restrict the write/rename and deletion of a component that gets added by default on the items for a specific role to a placeholder only. I cannot restrict the user ...
1
vote
1answer
295 views

500 Error on Experience Editor - Security [closed]

I'm getting a System.ArgumentNullException while in Preview or Experience Editor. I have since pointed a blank instance of Sitecore (8.1 update 3) to the dbs and can replicate the issue but cannot ...
3
votes
1answer
85 views

Sitecore using Dynamics CRM - which permission level does the user used in ConnectionStrings needs to have?

I have a Sitecore instance using Dynamics CRM within the follow ConnectionStrings.config <add name="Dynamics-2011" connectionString="url=http://crmdevvm:5555/crmdev/XRMServices/2011/Organization....
0
votes
0answers
373 views

Access rules for media library upload path

I have a multisite setup and I want to use a dedicated folder under media library for all the images that editors can upload to sitecore. And under that folder, I want to have subfolders per website, ...
4
votes
1answer
687 views

Get base or inherited roles from Role or User object

Is there any way from an API level to obtain a list of roles which are "base" roles from an existing Role object? i.e. the roles which would grant inherited read access? I've noticed that when ...
0
votes
1answer
184 views

Sitecore read access to get items, Sitecore 8.2u2

Do I need Read access to an item if I need codebehind to get that item programatically? Sitecore.Context.Database.GetItem(ID) will return null if I don't put read access on the item. My code worked ...
3
votes
1answer
487 views

How to properly enable Windows Authentication on the /login and /shell folders (or any Sitecore folder)

We want to lock down a Sitecore install when hitting it from the web with Windows Authentication to avoid brute force style attacks and to add a second layer of security on the web interfaces. ...
6
votes
2answers
255 views

Remove access to Shared presentation?

I am trying to remove access to shared presentation for a particular role. I have denied read on this item: /sitecore/content/Applications/WebEdit/Ribbons/Chunks/Layout Modes/Shared Layout. This ...
3
votes
1answer
326 views

Access to both Experience Profile and Presentation Details

I have a user that needs access to both Experience Profile and Presentation Details. We found a Sitecore KB reference (https://kb.sitecore.net/articles/820320) that stated if a user had the Author or ...
6
votes
1answer
185 views

Role will not be installed as it already exists

I have created a sitecore security accounts package with an updated permissions on roles. When i try to install it, its says "Role will not be installed as it already exists". Is that mean i can't ...
1
vote
3answers
811 views

Sitecore restrict users from accessing the page using Sitecore security

I have restricted the the access for the role "AdminUser" in the Access viewer as above. Later in the code when I am accessing using the below code try { if (Sitecore....
2
votes
1answer
684 views

Does implementing a WebApi service using ServicesApiController expose a significant security risk?

I have been following Anders Laub's tutorials on implementing some WebAPI controllers using ServicesApiController and just like at the bottom of this page I received the 403 Forbidden error when ...
5
votes
1answer
533 views

Check if a specific role has read access to an item

Is there a way to check if a specific user role has been granted read permission to a specific item? I've tried using item.Security.CanRead(role) but to no success (this returns true when I'd expect ...
3
votes
1answer
54 views

Forcing Express Migration Tool to Sync Security

Is there a way to force the Express Migration Tool (v1.0 in my case*) to re-syncronize security items. It seems that this is a known issue that it will only sync security users and roles once. (See ...
0
votes
3answers
2k views

Using the Security Disabler With Glass Mapper

I have a list of Photo items that I'm trying to get from my Glass Mapper model using the following declaration: SitecoreField("Photos")] public virtual IEnumerable<Photo> Photos { get; set; } ...