9

Modifying raw security values Open the Content Editor Locate the item that represents the template field On the View tab in the Ribbon, make sure the following checkboxes are checked: Standard fields Raw values Go to the Security section Insert the following text into the Security field: ar|sitecore\Everyone|pe|-field:write| Save the item. This will ...


9

Background When the ItemResolver processor executes, it determines the context item for the request based on the current URL. Additionally, it also performs a security check to see if the current user can access that item. If they can't, the context item is cleared and a PermissionDenied property on HttpRequestArgs is set to true. When the ExecuteRequest ...


8

The code you pasted above is incorrect. It doesn't check roles inheritance. item.Security.CanRead(role) method is exactly what you're looking for. If it returns you true when you expect it to return false, most probably you should check: AccessViewer application and see why that role has read access to the item role inheritance - maybe one of the base ...


7

Yes it is possible to disable the drag option. From my investigation, there are 2 ways you can disable it. Solution 1: Comment Out Javascript You can disable the drag and drop feature by commenting out the method initialize in the javascript. Navigate to the \Website\sitecore\shell\Applications\Content Manager\Content Editor.js. Open the Js file and ...


7

Yep, it's a bug, if I have time I'll report to Sitecore. So the solution is to create your own CustomItemResolver that inherits from ItemResolver. override the Process method, call the base.Process(args) (so you don't interfere on normal behavior of that processor then just check for permission the same way it is already doing but before finishing processing ...


7

If you need to get a base roles for role, you can use the GetRolesForRole(Role role, bool includeIndirectMembership) method of RolesInRolesManager. For example, if you need to get a base roles for each role of user, you can use something like below: foreach (var role in Sitecore.Context.User.Roles) { var basedRoldes = RolesInRolesManager....


7

You will need to use component personalization for this. That means all users get access to the page, but on the personalization rules for components you set exceptions based on security. For example: Here is a walkthrough on how to set up component personalization: https://doc.sitecore.net/sitecore_experience_platform/digital_marketing/personalization/...


6

You have two options here: Sitecore/Designer role has the permissions you need and I'd recommend to use it if you need to edit Data Source and Placeholder. Grant Write access for the "Client Designing" to the /sitecore/templates/System/Layout/Rendering Parameters/Standard Rendering Parameters/__Standard Values item. But be careful; if one role has access ...


6

For this menu option to show the user must have read access to the /sitecore/content/Applications/WebEdit/Common Field Buttons/Edit related item item in the Core database or be a member of the sitecore\Sitecore Client Designing Role.


6

I've written a powershell script which should do the magic for you. I suggest you backup your database before running it, just in case. It searches for ar|ROLE_DOMAIN\ROLE_NAME| string in __Security fields of all the items under the $root item, looks for the next role or user in the security, and duplicates that role access rights to the second role. The ...


5

Maybe I'm wrong but I'm afraid that what you want to achieve is not possible. The items which you changed access rights to are only HyperlinkButton Parameters item and Text Parameters item which means they hold text of the button, click action and help text. The whole button consist of more components: In frontend, I would use Sitecore personalization ...


4

So one thing I missed from my video was how to configure the roles for having access to various workflow states. You need to open the Security Editor and make sure to select the correct role to edit. In this case you will want to edit the Content Editor role. You will need to do two things to ensure that the Content Editor role can make changes. You ...


4

Sitecore security model does provide API for determining user access rights (see Sitecore.Security.AccessControl.ItemAccess class). AFAIK there is no any web service exposing it but you can easily create one using Sitecore Services Client: public class AccessController : ServicesApiController { [Route("sitecore/api/ssc/itemaccess/{database}/{itemId}")] ...


4

This requires a loginPage attribute on the site node, as indicated by the comments in Sitecore.Owin.Authentication.config: <!-- LOGIN PATH variable Specifies the login path prefix for federated authentication. It should be used in the "site" nodes in the "loginPage" attribute. The full login path must have this structure: $(loginPath)...


4

Use Role Inheritance Your existing roles, which contain the shared access rules that are common among all of the secondary roles, should be members of the secondary roles. Creating the Base Role For example, let's say that your Base Role, we'll call it "Base Author" has access to all of the Media Libary, and all of your shared content. This will ...


4

Easiest way I can think of would be to create multiple copies of the button, change the target url in each link to your desired target. Then set the security on those buttons for the roles that should get that "version" of the button. So deny view on the roles that shouldn't see it, and allow the view for the role that should. Once you add the users in the ...


4

You can use the Local Administrator Role to allow management of accounts within a domain. Sitecore local administrators can log in to Sitecore and manage the security applications (including assigning security) within that domain. A local administrator cannot create domains or associate domains to users. Read more in the Sitecore Docs


4

The sitecore\Sitecore Client Securing role grants access to features and applications used to assign access rights. Gives the user access rights to security features in the Content Editor and other relevant applications. This role is intended for users who need to maintain users and access rights. You need to assign the sitecore\Sitecore Client Account ...


3

Based on some discussion with Sitecore support, I learned that workbox items indeed are not supposed to be visible when locked unless you are an admin or the person who locked the item. Specifically in Sitecore.Shell.Applications.Workbox, the following code determines this: ArrayList arrayList = new ArrayList(items.Length); DataUri[] array = items; for (...


3

Sitecore items inherit security settings by default. An item can inherit the access rights that have been specified for other items that are higher up the content tree. Any item can be configured to inherit the security settings of its parent item. Sitecore allows you to configure which items should inherit security settings and which should not. The ...


3

If i understood correct, non admin users are not able to see the Media Library node under Sitecore. Just check the View tab and "Entire Tree" option, if it is unchecked then the media library will not be visible to the user. If your non admin user want to see everything [whatever he has access] then the "Hidden Items" needs to be checked. As an additional ...


3

Role based permissions and what items they affect are not contained on thr role itself. All security is actually an attribute/field on the item itself, and only maps to a role. The only data that a role has is to map which users are members of a specific role. You will need to package up the Content Items, in addition to the role (if the role isn't ...


3

To answer your question, its always good practice to add the same permissions to all lower environment but the point here is find out why the permission no longer exists. I think it depends on where you apply the permissions, in another words, if your deployment overrides the permissions on certain items which seems like the case. You should always bring ...


2

This is expected behavior as permissions are part of items. There are stored in Security section in Security field: Switch to 'Raw values' in View Toolbar to see it like above. It is always best practice to have same roles and permissions on all environments so all features are also testable. If you are not planning to add roles on all environments then ...


2

Long shot.. can you try disabling access to below item in core db for the user role and verify if this solves your problem.


2

Create them under: /sitecore/content/Applications/WebEdit/Edit Frame Buttons and you'll be able to edit specific section of the component. Its in Core database. To check what permissions navigate to /sitecore/content/Applications/WebEdit, there will be a list of granted permissions. The most granted is Client Developing, the least Authoring. Here is the ...


2

I ended up resolving this by adding Read and Write permissions for my role on the /sitecore/templates/System/Layout/Rendering Parameters/Standard Rendering Parameters/__Standard Values item.


2

Based on your description, I would assume that you have a page that contains a significant amount of content that is visible to anonymous users (and search engines) but you also want to be able to have additional content that is displayed if the user is authenticated. Differentiate Between URL Security and Content Security Given the above scenario, the ...


2

From Sitecore code comments: When a user logs in, Sitecore checks if the maximum number of users has been reached (as specified in the license). If so, the logout user web page is shown allowing the user to logout a existing session. There is a flag in Sitecore settings called AllowLogoutOfAllUsers which is set to false by default. If this flag is set ...


2

After a ticket to Sitecore support and some investigation of our own, we've had to go down the route of using sticky sessions. This keeps the user on the same CD after their initial login. Sitecore support confirmed my theory that the roles are not being persisted quick enough by the time the redirect is done: Properties of virtual users are stored in in-...


Only top voted, non community-wiki answers of a minimum length are eligible