11

I have a bunch of users that have almost admin like access to most items with a bunch of SDL Tridion 2011 environments.

The business would prefer that these users are not able to use the content porter tool to move things around from one environment to another.

I see in the Content Porter docs that Content Porter security seems to be based on the access permissions of the user, so I suspect it's quite difficult to restrict usage.

If there isn't a simple answer, anyone know of any work-arounds/tricks for this one?

Thanks

John

Improve this question
2
  • Are you using LDAP or windows authentication?
    – Chris Summers
    Jun 3, 2013 at 20:20
  • Interesting scenario. Even without content porter, authorized authors could make the same changes, but more slowly. :-)
    – Alvin Reyes
    Jun 3, 2013 at 20:53

3 Answers 3

Reset to default
10

You are correct that Content Porter permissions are based on the access permissions in the CMS. So I think you assume correctly that there is no easy/supported way to limit this.

If I were to try and change this, I would consider playing with security settings in IIS on the ImportExportService application under the CME website. You may be able to add some authorization rules to restrict only certain users to access that service.

Improve this answer
2
  • +1 for security on IIS. Unfortunately won't work with LDAP, but if you use Windows-based security you can at least restrict who can access the CP Webservice.
    – Nuno Linhares ♦
    Jun 3, 2013 at 19:54
  • I'd guess you could make LDAP work by writing some kind of provider plug-in. System.Web.Security would be a good place to start. In fact, you could do this for Windows security too, say if you wanted to use a Tridion group to control who could use the ImportExportService
    – Dominic Cronin
    Jun 3, 2013 at 20:53
8

As noted, once they have Content Porter available to them, what they can do with it is primarily controlled by their permissions and rights in Tridion. I'd look at controlling who can install Content Porter. Even though it is available as a click-once install via the GUI, you could probably prevent some users from installing it via a group policy. (Or failing that, prevent them from installing anything, and install Content Porter via a policy for the users that you want to have it.) You could probably use a group within Tridion to control a GUI extension that makes the content porter button disappear.

Improve this answer
2
  • Security by obscurity? Seems a bit questionable, but it could help in some cases I guess
    – Chris Summers
    Jun 3, 2013 at 20:28
  • Removing the button is not intended to stop people installing - you'd use a policy for that. In fact all three techniques could combine to make a total solution. And it's not about security, at least not security of your Tridion content. The permissions in Tridion cover that. If you don't want people changing your Tridion system, don't let them. This is about preventing people using tools that you don't think they should use.
    – Dominic Cronin
    Jun 3, 2013 at 20:50
3

One solution that I can suggest (if possible depending on your client) is having different Authentication mode for CME and Content Porter (ImportExportService).

For example:

If your CME is using the Windows Authentication, you may install & configure local LDAP on your server and create a replica of these users (to whom you want to give access to the Content Porter) in the LDAP. Further you then configure your Content Porter to use this LDAP for content porter authentication.

On the other hand, if your CME is already using the LDAP authentication then it may be a bit difficult but you may configure your Content Porter to use the Windows authentication and ask your clients to have users in the Active Directory (or whatever) for the Windows Authentication.

I hope it could be of bit help.

Improve this answer
1
  • thanks for the thoughts pankaj, i'm afraid this isn't possible with the client.
    – johnwinter
    Jun 4, 2013 at 21:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.