Any way to transfer all permissions from one role to another? The Next CEO of Stack OverflowAtlanta Sitecore User GroupGet base or inherited roles from Role or User object
How to be diplomatic in refusing to write code that breaches the privacy of our users
Was a professor correct to chastise me for writing "Prof. X" rather than "Professor X"?
How can I open an app using Terminal?
Why Were Madagascar and New Zealand Discovered So Late?
What is the point of a new vote on May's deal when the indicative votes suggest she will not win?
Anatomically Correct Mesopelagic Aves
What does this shorthand mean?
What makes a siege story/plot interesting?
How to safely derail a train during transit?
Fastest way to shutdown Ubuntu Mate 18.10
How do I go from 300 unfinished/half written blog posts, to published posts?
How to write papers efficiently when English isn't my first language?
forest, changing `s sep` such that it is at each second end node larger?
Only print output after finding pattern
Opposite of a diet
Unreliable Magic - Is it worth it?
When did Lisp start using symbols for arithmetic?
How do I solve this limit?
Apart from "berlinern", do any other German dialects have a corresponding verb?
Horror movie/show or scene where a horse creature opens its mouth really wide and devours a man in a stables
Customer Requests (Sometimes) Drive Me Bonkers!
Is it my responsibility to learn a new technology in my own time my employer wants to implement?
What can we do to stop prior company from asking us questions?
Why here is plural "We went to the movies last night."
Any way to transfer all permissions from one role to another?
The Next CEO of Stack OverflowAtlanta Sitecore User GroupGet base or inherited roles from Role or User object
We are going to have to create new roles for new content sections and it would be very helpful if we could transfer role permssions so that we don't have to reassign permissions for all the folders to secondary roles for a particular section.
Just wondering if there's a way to copy permissiosn from one role to another and then build on that second role to make the additional permission tweaks, which would be a lot easier than replicating every single folder/item permissions in the new role...
permissions
add a comment |
We are going to have to create new roles for new content sections and it would be very helpful if we could transfer role permssions so that we don't have to reassign permissions for all the folders to secondary roles for a particular section.
Just wondering if there's a way to copy permissiosn from one role to another and then build on that second role to make the additional permission tweaks, which would be a lot easier than replicating every single folder/item permissions in the new role...
permissions
Do you want to move permissions from Role A to Role B on particular items? So before the operation Role A has Read/Write and after only Role B has Read/Write? Or something more complex?
– Marek Musielak
8 hours ago
2
You would need a script, since security permissions are written as strings to the relevant items. However you could make Role B a member of Role A for the same effect - using Sitecore's Roles-in-Roles feature.
– Mark Cassidy♦
8 hours ago
@MarekMusielak, Role A has permissions for x number of items, at then end of the process Role A and Role B would have permissions on all those same items - the exact same permissions would be for each. Once that is done, I would then go into Role Manager and make some small alterations in Role B's permssions.
– Levi Wallach
8 hours ago
@MarkCassidy, by script do you mean a sql script or powershell? I can't make Role B a member of role A becuase I would then have to overwrite a bunch of permissions for Role B. Basically Role A will have full access to some global level items as well as for sub items, Role B will have full permissions just for subitems, and just read access to global level items. So my thinking was copy the global permissions to B, then just remove all the write/delete/create permissions to the global items.
– Levi Wallach
8 hours ago
add a comment |
We are going to have to create new roles for new content sections and it would be very helpful if we could transfer role permssions so that we don't have to reassign permissions for all the folders to secondary roles for a particular section.
Just wondering if there's a way to copy permissiosn from one role to another and then build on that second role to make the additional permission tweaks, which would be a lot easier than replicating every single folder/item permissions in the new role...
permissions
We are going to have to create new roles for new content sections and it would be very helpful if we could transfer role permssions so that we don't have to reassign permissions for all the folders to secondary roles for a particular section.
Just wondering if there's a way to copy permissiosn from one role to another and then build on that second role to make the additional permission tweaks, which would be a lot easier than replicating every single folder/item permissions in the new role...
permissions
permissions
asked 8 hours ago
Levi WallachLevi Wallach
1666
1666
Do you want to move permissions from Role A to Role B on particular items? So before the operation Role A has Read/Write and after only Role B has Read/Write? Or something more complex?
– Marek Musielak
8 hours ago
2
You would need a script, since security permissions are written as strings to the relevant items. However you could make Role B a member of Role A for the same effect - using Sitecore's Roles-in-Roles feature.
– Mark Cassidy♦
8 hours ago
@MarekMusielak, Role A has permissions for x number of items, at then end of the process Role A and Role B would have permissions on all those same items - the exact same permissions would be for each. Once that is done, I would then go into Role Manager and make some small alterations in Role B's permssions.
– Levi Wallach
8 hours ago
@MarkCassidy, by script do you mean a sql script or powershell? I can't make Role B a member of role A becuase I would then have to overwrite a bunch of permissions for Role B. Basically Role A will have full access to some global level items as well as for sub items, Role B will have full permissions just for subitems, and just read access to global level items. So my thinking was copy the global permissions to B, then just remove all the write/delete/create permissions to the global items.
– Levi Wallach
8 hours ago
add a comment |
Do you want to move permissions from Role A to Role B on particular items? So before the operation Role A has Read/Write and after only Role B has Read/Write? Or something more complex?
– Marek Musielak
8 hours ago
2
You would need a script, since security permissions are written as strings to the relevant items. However you could make Role B a member of Role A for the same effect - using Sitecore's Roles-in-Roles feature.
– Mark Cassidy♦
8 hours ago
@MarekMusielak, Role A has permissions for x number of items, at then end of the process Role A and Role B would have permissions on all those same items - the exact same permissions would be for each. Once that is done, I would then go into Role Manager and make some small alterations in Role B's permssions.
– Levi Wallach
8 hours ago
@MarkCassidy, by script do you mean a sql script or powershell? I can't make Role B a member of role A becuase I would then have to overwrite a bunch of permissions for Role B. Basically Role A will have full access to some global level items as well as for sub items, Role B will have full permissions just for subitems, and just read access to global level items. So my thinking was copy the global permissions to B, then just remove all the write/delete/create permissions to the global items.
– Levi Wallach
8 hours ago
Do you want to move permissions from Role A to Role B on particular items? So before the operation Role A has Read/Write and after only Role B has Read/Write? Or something more complex?
– Marek Musielak
8 hours ago
Do you want to move permissions from Role A to Role B on particular items? So before the operation Role A has Read/Write and after only Role B has Read/Write? Or something more complex?
– Marek Musielak
8 hours ago
2
2
You would need a script, since security permissions are written as strings to the relevant items. However you could make Role B a member of Role A for the same effect - using Sitecore's Roles-in-Roles feature.
– Mark Cassidy♦
8 hours ago
You would need a script, since security permissions are written as strings to the relevant items. However you could make Role B a member of Role A for the same effect - using Sitecore's Roles-in-Roles feature.
– Mark Cassidy♦
8 hours ago
@MarekMusielak, Role A has permissions for x number of items, at then end of the process Role A and Role B would have permissions on all those same items - the exact same permissions would be for each. Once that is done, I would then go into Role Manager and make some small alterations in Role B's permssions.
– Levi Wallach
8 hours ago
@MarekMusielak, Role A has permissions for x number of items, at then end of the process Role A and Role B would have permissions on all those same items - the exact same permissions would be for each. Once that is done, I would then go into Role Manager and make some small alterations in Role B's permssions.
– Levi Wallach
8 hours ago
@MarkCassidy, by script do you mean a sql script or powershell? I can't make Role B a member of role A becuase I would then have to overwrite a bunch of permissions for Role B. Basically Role A will have full access to some global level items as well as for sub items, Role B will have full permissions just for subitems, and just read access to global level items. So my thinking was copy the global permissions to B, then just remove all the write/delete/create permissions to the global items.
– Levi Wallach
8 hours ago
@MarkCassidy, by script do you mean a sql script or powershell? I can't make Role B a member of role A becuase I would then have to overwrite a bunch of permissions for Role B. Basically Role A will have full access to some global level items as well as for sub items, Role B will have full permissions just for subitems, and just read access to global level items. So my thinking was copy the global permissions to B, then just remove all the write/delete/create permissions to the global items.
– Levi Wallach
8 hours ago
add a comment |
2 Answers
2
active
oldest
votes
I've written a powershell script which should do the magic for you. I suggest you backup your database before running it, just in case.
It searches for ar|ROLE_DOMAINROLE_NAME|
string in __Security
fields of all the items under the $root
item, looks for the next role or user in the security, and duplicates that role access rights to the second role.
The script only takes into account access rights assigned to the role directly - it doesn't take into account access rights inherited from other roles.
#settings
$roleName = "sitecoreRoleA"
$newRoleName = "sitecoreRoleB"
$root = "110D559F-DEA5-42EA-9C1C-8A5DF7E70EF9"
$roleSecurityString = "ar|" + $roleName + "|"
$items = @(Get-Item -Path $root) + @(Get-ChildItem -Path $root -Recurse)
foreach ($item in $items)
if ($item["__Security"].Contains($roleSecurityString)) ar
I do not disagree that Marek has provided a solution. However, I have a POV that this is an excessive amount of work indicating that roles were not setup correctly in the first place. While I have upvoted I think fixing the role strategy is a better approach.
– Pete Navarra
4 hours ago
1
Pete I totally agree. Setting roles and access rights is not a 5 minutes task and should be planned properly. I think your answer describes what should have been done in the first place so +1 for you
– Marek Musielak
3 hours ago
add a comment |
Use Role Inheritance
Your existing roles, which contain the shared access rules that are common among all of the secondary roles, should be members of the secondary roles.
Creating the Base Role
For example, let's say that your Base Role, we'll call it "Base Author" has access to all of the Media Libary, and all of your shared content. This will include all of the shared items and Sitecore default roles (as members) that are common among all of the secondary roles. So it might look something like this:
And in Security Editor:
Creating the Secondary Role
So for the purposes of this example, I'm going to call my role "Headmaster Editor". It's a member of the Base Author role.
In Security Editor:
Assign the Secondary Role only to a user:
Adding the secondary role inherits all of the other roles.
Magic Permission - Breaking Inheritance
Breaking the Inheritance of Descendants makes it possible to prevent any access to any content item UNLESS it has been given a Green Check mark in Security editor. Sitecore's role security is strict on "Red X's" for preventing access. Once a role has a Red X, it doesn't matter if other roles have Green Checkmarks, that user won't have access. So, instead of doling out Red X's, break the inheritance, and then only provide given access via Green Checkmarks. I do this by taking the sitecore/Author role, which is out of the box, and breaking the descendent inheritance on the /sitecore/content item.
Reviewing our Work
Base Author Role
You can see here that Base Author Role only has access to the items that we gave it above.
Headmaster Editor Role
But that the Headmaster Role has everything in the Base + Plus the content from the Headmaster Role.
In Summary
The art and magic of role permissions is to be as simple as possible. If you're checking boxes all over the place and using red x's all over the place, you're doing it wrong. Keep it simple.
1
Part of the issue is that the "base" user that I'm setting up has full access to most areas, whereas the secondary user would only have full access to certain subitems and only read access to the higher level items. I guess I'll have to play with the inheritance access right a little, maybe you are right in that this can be done fairly easily just with that... I do have a "Base" role that all users get which restrict inheritance rights on most items. Will see what I can do once I have the branch template working well...
– Levi Wallach
6 hours ago
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "664"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsitecore.stackexchange.com%2fquestions%2f17766%2fany-way-to-transfer-all-permissions-from-one-role-to-another%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
I've written a powershell script which should do the magic for you. I suggest you backup your database before running it, just in case.
It searches for ar|ROLE_DOMAINROLE_NAME|
string in __Security
fields of all the items under the $root
item, looks for the next role or user in the security, and duplicates that role access rights to the second role.
The script only takes into account access rights assigned to the role directly - it doesn't take into account access rights inherited from other roles.
#settings
$roleName = "sitecoreRoleA"
$newRoleName = "sitecoreRoleB"
$root = "110D559F-DEA5-42EA-9C1C-8A5DF7E70EF9"
$roleSecurityString = "ar|" + $roleName + "|"
$items = @(Get-Item -Path $root) + @(Get-ChildItem -Path $root -Recurse)
foreach ($item in $items)
if ($item["__Security"].Contains($roleSecurityString)) ar
I do not disagree that Marek has provided a solution. However, I have a POV that this is an excessive amount of work indicating that roles were not setup correctly in the first place. While I have upvoted I think fixing the role strategy is a better approach.
– Pete Navarra
4 hours ago
1
Pete I totally agree. Setting roles and access rights is not a 5 minutes task and should be planned properly. I think your answer describes what should have been done in the first place so +1 for you
– Marek Musielak
3 hours ago
add a comment |
I've written a powershell script which should do the magic for you. I suggest you backup your database before running it, just in case.
It searches for ar|ROLE_DOMAINROLE_NAME|
string in __Security
fields of all the items under the $root
item, looks for the next role or user in the security, and duplicates that role access rights to the second role.
The script only takes into account access rights assigned to the role directly - it doesn't take into account access rights inherited from other roles.
#settings
$roleName = "sitecoreRoleA"
$newRoleName = "sitecoreRoleB"
$root = "110D559F-DEA5-42EA-9C1C-8A5DF7E70EF9"
$roleSecurityString = "ar|" + $roleName + "|"
$items = @(Get-Item -Path $root) + @(Get-ChildItem -Path $root -Recurse)
foreach ($item in $items)
if ($item["__Security"].Contains($roleSecurityString)) ar
I do not disagree that Marek has provided a solution. However, I have a POV that this is an excessive amount of work indicating that roles were not setup correctly in the first place. While I have upvoted I think fixing the role strategy is a better approach.
– Pete Navarra
4 hours ago
1
Pete I totally agree. Setting roles and access rights is not a 5 minutes task and should be planned properly. I think your answer describes what should have been done in the first place so +1 for you
– Marek Musielak
3 hours ago
add a comment |
I've written a powershell script which should do the magic for you. I suggest you backup your database before running it, just in case.
It searches for ar|ROLE_DOMAINROLE_NAME|
string in __Security
fields of all the items under the $root
item, looks for the next role or user in the security, and duplicates that role access rights to the second role.
The script only takes into account access rights assigned to the role directly - it doesn't take into account access rights inherited from other roles.
#settings
$roleName = "sitecoreRoleA"
$newRoleName = "sitecoreRoleB"
$root = "110D559F-DEA5-42EA-9C1C-8A5DF7E70EF9"
$roleSecurityString = "ar|" + $roleName + "|"
$items = @(Get-Item -Path $root) + @(Get-ChildItem -Path $root -Recurse)
foreach ($item in $items)
if ($item["__Security"].Contains($roleSecurityString)) ar
I've written a powershell script which should do the magic for you. I suggest you backup your database before running it, just in case.
It searches for ar|ROLE_DOMAINROLE_NAME|
string in __Security
fields of all the items under the $root
item, looks for the next role or user in the security, and duplicates that role access rights to the second role.
The script only takes into account access rights assigned to the role directly - it doesn't take into account access rights inherited from other roles.
#settings
$roleName = "sitecoreRoleA"
$newRoleName = "sitecoreRoleB"
$root = "110D559F-DEA5-42EA-9C1C-8A5DF7E70EF9"
$roleSecurityString = "ar|" + $roleName + "|"
$items = @(Get-Item -Path $root) + @(Get-ChildItem -Path $root -Recurse)
foreach ($item in $items)
if ($item["__Security"].Contains($roleSecurityString)) ar
answered 6 hours ago
Marek MusielakMarek Musielak
11.2k11136
11.2k11136
I do not disagree that Marek has provided a solution. However, I have a POV that this is an excessive amount of work indicating that roles were not setup correctly in the first place. While I have upvoted I think fixing the role strategy is a better approach.
– Pete Navarra
4 hours ago
1
Pete I totally agree. Setting roles and access rights is not a 5 minutes task and should be planned properly. I think your answer describes what should have been done in the first place so +1 for you
– Marek Musielak
3 hours ago
add a comment |
I do not disagree that Marek has provided a solution. However, I have a POV that this is an excessive amount of work indicating that roles were not setup correctly in the first place. While I have upvoted I think fixing the role strategy is a better approach.
– Pete Navarra
4 hours ago
1
Pete I totally agree. Setting roles and access rights is not a 5 minutes task and should be planned properly. I think your answer describes what should have been done in the first place so +1 for you
– Marek Musielak
3 hours ago
I do not disagree that Marek has provided a solution. However, I have a POV that this is an excessive amount of work indicating that roles were not setup correctly in the first place. While I have upvoted I think fixing the role strategy is a better approach.
– Pete Navarra
4 hours ago
I do not disagree that Marek has provided a solution. However, I have a POV that this is an excessive amount of work indicating that roles were not setup correctly in the first place. While I have upvoted I think fixing the role strategy is a better approach.
– Pete Navarra
4 hours ago
1
1
Pete I totally agree. Setting roles and access rights is not a 5 minutes task and should be planned properly. I think your answer describes what should have been done in the first place so +1 for you
– Marek Musielak
3 hours ago
Pete I totally agree. Setting roles and access rights is not a 5 minutes task and should be planned properly. I think your answer describes what should have been done in the first place so +1 for you
– Marek Musielak
3 hours ago
add a comment |
Use Role Inheritance
Your existing roles, which contain the shared access rules that are common among all of the secondary roles, should be members of the secondary roles.
Creating the Base Role
For example, let's say that your Base Role, we'll call it "Base Author" has access to all of the Media Libary, and all of your shared content. This will include all of the shared items and Sitecore default roles (as members) that are common among all of the secondary roles. So it might look something like this:
And in Security Editor:
Creating the Secondary Role
So for the purposes of this example, I'm going to call my role "Headmaster Editor". It's a member of the Base Author role.
In Security Editor:
Assign the Secondary Role only to a user:
Adding the secondary role inherits all of the other roles.
Magic Permission - Breaking Inheritance
Breaking the Inheritance of Descendants makes it possible to prevent any access to any content item UNLESS it has been given a Green Check mark in Security editor. Sitecore's role security is strict on "Red X's" for preventing access. Once a role has a Red X, it doesn't matter if other roles have Green Checkmarks, that user won't have access. So, instead of doling out Red X's, break the inheritance, and then only provide given access via Green Checkmarks. I do this by taking the sitecore/Author role, which is out of the box, and breaking the descendent inheritance on the /sitecore/content item.
Reviewing our Work
Base Author Role
You can see here that Base Author Role only has access to the items that we gave it above.
Headmaster Editor Role
But that the Headmaster Role has everything in the Base + Plus the content from the Headmaster Role.
In Summary
The art and magic of role permissions is to be as simple as possible. If you're checking boxes all over the place and using red x's all over the place, you're doing it wrong. Keep it simple.
1
Part of the issue is that the "base" user that I'm setting up has full access to most areas, whereas the secondary user would only have full access to certain subitems and only read access to the higher level items. I guess I'll have to play with the inheritance access right a little, maybe you are right in that this can be done fairly easily just with that... I do have a "Base" role that all users get which restrict inheritance rights on most items. Will see what I can do once I have the branch template working well...
– Levi Wallach
6 hours ago
add a comment |
Use Role Inheritance
Your existing roles, which contain the shared access rules that are common among all of the secondary roles, should be members of the secondary roles.
Creating the Base Role
For example, let's say that your Base Role, we'll call it "Base Author" has access to all of the Media Libary, and all of your shared content. This will include all of the shared items and Sitecore default roles (as members) that are common among all of the secondary roles. So it might look something like this:
And in Security Editor:
Creating the Secondary Role
So for the purposes of this example, I'm going to call my role "Headmaster Editor". It's a member of the Base Author role.
In Security Editor:
Assign the Secondary Role only to a user:
Adding the secondary role inherits all of the other roles.
Magic Permission - Breaking Inheritance
Breaking the Inheritance of Descendants makes it possible to prevent any access to any content item UNLESS it has been given a Green Check mark in Security editor. Sitecore's role security is strict on "Red X's" for preventing access. Once a role has a Red X, it doesn't matter if other roles have Green Checkmarks, that user won't have access. So, instead of doling out Red X's, break the inheritance, and then only provide given access via Green Checkmarks. I do this by taking the sitecore/Author role, which is out of the box, and breaking the descendent inheritance on the /sitecore/content item.
Reviewing our Work
Base Author Role
You can see here that Base Author Role only has access to the items that we gave it above.
Headmaster Editor Role
But that the Headmaster Role has everything in the Base + Plus the content from the Headmaster Role.
In Summary
The art and magic of role permissions is to be as simple as possible. If you're checking boxes all over the place and using red x's all over the place, you're doing it wrong. Keep it simple.
1
Part of the issue is that the "base" user that I'm setting up has full access to most areas, whereas the secondary user would only have full access to certain subitems and only read access to the higher level items. I guess I'll have to play with the inheritance access right a little, maybe you are right in that this can be done fairly easily just with that... I do have a "Base" role that all users get which restrict inheritance rights on most items. Will see what I can do once I have the branch template working well...
– Levi Wallach
6 hours ago
add a comment |
Use Role Inheritance
Your existing roles, which contain the shared access rules that are common among all of the secondary roles, should be members of the secondary roles.
Creating the Base Role
For example, let's say that your Base Role, we'll call it "Base Author" has access to all of the Media Libary, and all of your shared content. This will include all of the shared items and Sitecore default roles (as members) that are common among all of the secondary roles. So it might look something like this:
And in Security Editor:
Creating the Secondary Role
So for the purposes of this example, I'm going to call my role "Headmaster Editor". It's a member of the Base Author role.
In Security Editor:
Assign the Secondary Role only to a user:
Adding the secondary role inherits all of the other roles.
Magic Permission - Breaking Inheritance
Breaking the Inheritance of Descendants makes it possible to prevent any access to any content item UNLESS it has been given a Green Check mark in Security editor. Sitecore's role security is strict on "Red X's" for preventing access. Once a role has a Red X, it doesn't matter if other roles have Green Checkmarks, that user won't have access. So, instead of doling out Red X's, break the inheritance, and then only provide given access via Green Checkmarks. I do this by taking the sitecore/Author role, which is out of the box, and breaking the descendent inheritance on the /sitecore/content item.
Reviewing our Work
Base Author Role
You can see here that Base Author Role only has access to the items that we gave it above.
Headmaster Editor Role
But that the Headmaster Role has everything in the Base + Plus the content from the Headmaster Role.
In Summary
The art and magic of role permissions is to be as simple as possible. If you're checking boxes all over the place and using red x's all over the place, you're doing it wrong. Keep it simple.
Use Role Inheritance
Your existing roles, which contain the shared access rules that are common among all of the secondary roles, should be members of the secondary roles.
Creating the Base Role
For example, let's say that your Base Role, we'll call it "Base Author" has access to all of the Media Libary, and all of your shared content. This will include all of the shared items and Sitecore default roles (as members) that are common among all of the secondary roles. So it might look something like this:
And in Security Editor:
Creating the Secondary Role
So for the purposes of this example, I'm going to call my role "Headmaster Editor". It's a member of the Base Author role.
In Security Editor:
Assign the Secondary Role only to a user:
Adding the secondary role inherits all of the other roles.
Magic Permission - Breaking Inheritance
Breaking the Inheritance of Descendants makes it possible to prevent any access to any content item UNLESS it has been given a Green Check mark in Security editor. Sitecore's role security is strict on "Red X's" for preventing access. Once a role has a Red X, it doesn't matter if other roles have Green Checkmarks, that user won't have access. So, instead of doling out Red X's, break the inheritance, and then only provide given access via Green Checkmarks. I do this by taking the sitecore/Author role, which is out of the box, and breaking the descendent inheritance on the /sitecore/content item.
Reviewing our Work
Base Author Role
You can see here that Base Author Role only has access to the items that we gave it above.
Headmaster Editor Role
But that the Headmaster Role has everything in the Base + Plus the content from the Headmaster Role.
In Summary
The art and magic of role permissions is to be as simple as possible. If you're checking boxes all over the place and using red x's all over the place, you're doing it wrong. Keep it simple.
answered 8 hours ago
Pete NavarraPete Navarra
11.2k2675
11.2k2675
1
Part of the issue is that the "base" user that I'm setting up has full access to most areas, whereas the secondary user would only have full access to certain subitems and only read access to the higher level items. I guess I'll have to play with the inheritance access right a little, maybe you are right in that this can be done fairly easily just with that... I do have a "Base" role that all users get which restrict inheritance rights on most items. Will see what I can do once I have the branch template working well...
– Levi Wallach
6 hours ago
add a comment |
1
Part of the issue is that the "base" user that I'm setting up has full access to most areas, whereas the secondary user would only have full access to certain subitems and only read access to the higher level items. I guess I'll have to play with the inheritance access right a little, maybe you are right in that this can be done fairly easily just with that... I do have a "Base" role that all users get which restrict inheritance rights on most items. Will see what I can do once I have the branch template working well...
– Levi Wallach
6 hours ago
1
1
Part of the issue is that the "base" user that I'm setting up has full access to most areas, whereas the secondary user would only have full access to certain subitems and only read access to the higher level items. I guess I'll have to play with the inheritance access right a little, maybe you are right in that this can be done fairly easily just with that... I do have a "Base" role that all users get which restrict inheritance rights on most items. Will see what I can do once I have the branch template working well...
– Levi Wallach
6 hours ago
Part of the issue is that the "base" user that I'm setting up has full access to most areas, whereas the secondary user would only have full access to certain subitems and only read access to the higher level items. I guess I'll have to play with the inheritance access right a little, maybe you are right in that this can be done fairly easily just with that... I do have a "Base" role that all users get which restrict inheritance rights on most items. Will see what I can do once I have the branch template working well...
– Levi Wallach
6 hours ago
add a comment |
Thanks for contributing an answer to Sitecore Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsitecore.stackexchange.com%2fquestions%2f17766%2fany-way-to-transfer-all-permissions-from-one-role-to-another%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Do you want to move permissions from Role A to Role B on particular items? So before the operation Role A has Read/Write and after only Role B has Read/Write? Or something more complex?
– Marek Musielak
8 hours ago
2
You would need a script, since security permissions are written as strings to the relevant items. However you could make Role B a member of Role A for the same effect - using Sitecore's Roles-in-Roles feature.
– Mark Cassidy♦
8 hours ago
@MarekMusielak, Role A has permissions for x number of items, at then end of the process Role A and Role B would have permissions on all those same items - the exact same permissions would be for each. Once that is done, I would then go into Role Manager and make some small alterations in Role B's permssions.
– Levi Wallach
8 hours ago
@MarkCassidy, by script do you mean a sql script or powershell? I can't make Role B a member of role A becuase I would then have to overwrite a bunch of permissions for Role B. Basically Role A will have full access to some global level items as well as for sub items, Role B will have full permissions just for subitems, and just read access to global level items. So my thinking was copy the global permissions to B, then just remove all the write/delete/create permissions to the global items.
– Levi Wallach
8 hours ago