London Dev Meetup Rescheduled! Due to unavoidable reasons, the event has been moved to 21st May. Speakers remain the same—any changes will be communicated. Seats are limited—register here to secure your spot!

AI OnAI Off
Navigation [hide] [expand]
Area: Optimizely CMS
ARCHIVED This content is retired and no longer maintained. See the latest version here.

Permissions to functions

Episerver has a built-in system for assigning permissions to individual functions. You can assign users and roles to a permission in the administrative interface under Config > Permissions to functions. Built-in permissions include the ability to access web services and viewing detailed exception messages.

Using permissions to functions

The API for querying whether a user is permitted to perform a function is available via EPiServer.Security.PermissionService or via PrincipalInfo as a simplified API.

            //Alt 1
            bool hasPermission = ServiceLocator.Current.GetInstance<PermissionService>().IsPermitted(HttpContext.Current.User, SystemPermissions.DetailedErrorMessage);

            //Alt 2
            bool hasPermission = PrincipalInfo.Current.IsPermitted(SystemPermissions.DetailedErrorMessage);

Define permissions to functions in code

You can define custom permissions to functions by defining a class as shown in the following example. Classes with the PermissionTypes attribute are automatically picked up by Episerver and appear in the administrative interface. Permission names must be unique within a group, so pick a group name that is unique to your solution. You also can register permission types via EPiServer.DataAbstraction.PermissionTypeRepository to support dynamic creation of permissions.

    [PermissionTypes]
    public static class MyCustomPermissions
    {
        public const string GroupName = "MyCustomPermissions";

        static MyCustomPermissions()
        {
            EditSettings = new PermissionType(GroupName, "EditSettings");
            ViewSettings = new PermissionType(GroupName, "ViewSettings");
        }

        public static PermissionType EditSettings { get; private set; }

        public static PermissionType ViewSettings { get; private set; }
    }

You can define readable descriptions for the group and the permissions that are shown in the user interface by adding an entry to a language resource file. Under <groups>, name the GroupName (such as <MyCustomPermissions>) in which you place a <description> and node permission names (such as <EditSettings> and <ViewSettings>) as shown in the following example.

<?xml version="1.0" encoding="utf-8" standalone="yes"?>
<languages>
  <language name="English" id="en">
    <admin>
      <permissiontype>
        <groups>
          <MyCustomPermissions>
            <description>Custom settings fuctions</description>
            <permissions>
              <EditSettings>Allows users to access edit settings</EditSettings>
              <ViewSettings>Allows users to access view settings</ViewSettings>
            </permissions>
          </MyCustomPermissions>
        </groups>
      </permissiontype>
    </admin>
  </language>
</languages>

Protecting a controller via a permission

Use the AuthorizePermission attribute to authorize a MVC controller via permissions to functions:

    [AuthorizePermission("MyCustomPermissions", "EditSettings")]
    public class EditSettingsController : Controller
    {
        public ActionResult Index()
        {
            return View();
        }
    }

Using virtual roles to expose permissions to other systems

Some systems cannot validate permissions but can validate roles. In these cases, you can expose a permission as a role:

    [InitializableModule]
    [ModuleDependency((typeof(EPiServer.Web.InitializationModule)))]
    public class VirtualRoleInitializer : IInitializableModule
    {
        public void Initialize(InitializationEngine context)
        {
            var virtualRoleRepository = VirtualRoleRepository<VirtualRoleProviderBase>.GetDefault();

            virtualRoleRepository.Register("EditSettingsVirtualRole", new PermissionRole
            {
                Permission = MyCustomPermissions.EditSettings
            });
        }

        public void Uninitialize(InitializationEngine context) { }
        public void Preload(string[] parameters) { }
    }

Last updated: Sep 21, 2015