Just installed the April CTP version of this amazing product on my new dual core 2.0 Ghz/2Gb laptop.
The first step was to make it look like Vista.
Next thing was to disable the enhanced internet security configuration from the Control Panel. Feels good! Looking forward to go through the labs to get into IIS7.
Performance? I will add the SQL Server and Visual Studio and we'll see. It is pretty fast right now.
This means that now you can deny read access in the security or extranet databases:
It is not all that you should do though, because the User Manager won't just respect this security settings. So the second step is to override this application. It is fairly simple:
1. Copy the XML control source file named Security manager.xml from "\sitecore\shell\Applications\Security\Security manager\" to "\sitecore\shell\override".
2. Don't forget about this when upgrading :-)
3. Compile the following code for this form and place the assembly to the bin folder. Here is the source:
using System;
using System.Data;
using System.Configuration;
using System.Web;
using System.Web.Security;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Web.UI.HtmlControls;
using System.Collections;
using Sitecore;
using Sitecore.Data;
using Sitecore.Data.Items;
using Sitecore.SecurityModel;
using Sitecore.Configuration;
using Sitecore.Web.UI.HtmlControls;
namespace WiseBusiness.Shell.Security
{
public class CustomSecurityManagerForm : Sitecore.Shell.Applications.Security.SecurityManager.SecurityManagerForm
{
private ArrayList deniedItems = new ArrayList();
protected override void OnLoad(EventArgs e)
{
base.OnLoad(e);
if (!Sitecore.Context.ClientPage.IsEvent)
{
// we should respect administrators
if (!Sitecore.Context.User.IsAdministrator)
{
// fill the array list of item the current user does not have access to
GetDeniedItems();
string deniedItemIDs = ArrayListToString(deniedItems, ",");
if (deniedItemIDs != string.Empty)
{
// setting the data context excluding items that the current item does not have access to
this.FilteredDataContext.Filter = "not(Contains('" + deniedItemIDs + "', @@id))";
this.DataContext.Filter = "not(Contains('" + deniedItemIDs + "', @@id))";
}
}
}
}
private string ArrayListToString(System.Collections.ArrayList ar, string delim)
{
return string.Join(delim, (string[])ar.ToArray(typeof(string)));
}
private void GetDeniedItems()
{
// getting the selected domain
Database database = Factory.GetDomain(this.Domain).Database;
if (database != null)
{
// checking security recursively
ProcessItem(database.GetRootItem());
}
}
private void ProcessItem(Item parent)
{
foreach (Item child in parent.Children)
{
using (new SecurityDisabler())
{
// check if the context user cannot read the current item
if (child.SecurityField.GetRights(Sitecore.Context.User, true) == ItemRights.DenyRead)
{
deniedItems.Add(child.ID.ToString());
}
}
ProcessItem(child);
}
}
}
}
The comments in the code should help to understand the concept. If not, shoot me a message.
The key things:
- Inheriting from the existing User Manager form.
- Calling the base OnLoad method thanks to the power of inheritance.
- Modifying the FilteredDataContext's and DataContext's filters to exclude security items that the current user does not have access to.
4. Make the following change in the XML control source file to reference the newly compiled class (as usual):
<CodeBeside type="WiseBusiness.Shell.Security.CustomSecurityManagerForm,WiseBusiness" />
Here is the resulting picture in the User Manager for the user:
As can be seen, this user cannot see the roles container, system users and user named dominic.
Of course, the code might be far from perfect but I am open to suggestions!
Update: this will be addressed in next major release.