Restricting Page Display in Edit Mode

Hiding parts of the page tree or entire sites in Edit mode in EPiServer CMS is sometimes desirable when working in a large and complex multi-site environment with editors from different organizations or companies. With this approach, editors will only see their authorized sites and pages in Edit mode. This article describes how this is done in an enterprise environment with multiple sites.

Background

The authentication and authorization system in EPiServer CMS uses the default membership and role system in ASP.NET. Authentication identifies the user, usually by providing a user name and password. Authorization determines the specific action a user is allowed to perform, what to do (edit/publish) and where in the site structure.

In a new installation of EPiServer CMS, you get a number of default groups. Of these default groups, the following are of interest in the context of this discussion:

• WebAdmins – An EPiServer specific group providing access to Admin mode.
• WebEditors – An EPiServer specific group providing access to Edit mode.
• Everyone – A Windows virtual role which controls the website access for (anonymous) users in View mode, but also the page tree display in Edit mode.
• Anonymous – A Windows virtual role providing access for (anonymous) users in View mode.

A basic rule when working with authorization in EPiServer CMS, is that the WebEditors group must only be used for providing access to Edit mode, not for setting access rights in the page tree structure. This is because all editors must always be included in the WebEditors group to get access to Edit mode, and thus the group cannot be used for structure access rights.

Therefore, you should work with structure groups to set access rights for pages in the page tree structure. You can for instance create a group called "ProductEditors" which only has access rights to work in the page tree node "Products". Also, in a standard setup, the Everyone group must have read access to pages for these to be visible in View mode to anonymous visitors.

This means that when an editor logs into Edit mode, the entire page tree will be visible, and pages to which the editor is not authorized, will be marked as locked. This is the default behavior.

Instead of this, what if you could hide parts of a page tree structure, or websites in a multi site structure, to unauthorized editors? This can be done by altering the default user group settings in EPiServer CMS.

Scenario

Imagine an enterprise environment with multiple sites where different editor groups manage their specific websites in the same page tree structure. In this example we have a main site "Home", and three other websites in a multi site setup.

In this case we want to hide the websites "Facebook", "Customer Zone" and "Alloy Mobile" from editors working with the main "Home" site. These sites should only be visible to authorized editors in Edit mode, but visible to all visitors in View mode.

Solution

This is done using the "Anonymous" group instead of "Everyone" when applying access rights. If only "Anonymous" is allowed to read a page the page will not be displayed in the page tree in Edit mode for authenticated users.

In this example we will use the following editor structure groups:

• MainSitePublishers – will have full access rights to work with the main site "Home".
• SitePublishers – will have full access rights to work with the hidden sites.

In Admin mode under "Access Rights", we will do the following to each of the sites we want to hide:

1. Remove the "Everyone" group.
2. Add the "Anonymous" group and set "Read" access rights.
3. Add the "SitePublishers" group and set the desired read/publish access rights.
4. Apply the settings for sub-pages.

This is what the access rights settings will look like for instance for the "Customer Zone" website.

These are the user group settings for an editor working with the "Home" website, and without authorization to the hidden sites.

When this user logs into the site structure and accesses Edit mode, only the "Home" page node will be visible.

Considerations

Before applying this approach to restrict page display in Edit mode, there are some things to consider. The related functionality in EPiServer CMS will follow the access rights set up, meaning that in situations where a page tree is displayed, the editor will only see the authorized pages, for instance when creating internal links, dynamic content and shortcuts. The same applies to global search, gadgets and pages in the recycle bin.

However, to fully apply this way of working you may also need to use the same concept for the File Manager, if you don't want files from the different websites to be visible to all editors. Replacing "Everyone" with "Anonymous" and setting access rights as previously described for pages, will provide the same control also for the display of files.

Related Information

Authentication and Authorization in EPiServer CMS 6 (article)

Authentication and Authorization in EPiServer CMS (tech note)

Configuration - Active Directory Membership Provider

Securing Edit and Admin

Comments