11

After a bit of experimentation it turns out that Category Management is a Right specifically to allow creating and modifying Categories, however it does not control the ability to work with Keywords within. Permissions on the Category control what groups can RWDL Keywords. So to prevent a group from being able to create or modify Categories while still ...


11

One possibility might be to map multiple host headers for your CM site, and of course, also in your hosts file. So then you could log in on one tab of your browser to http://devs.tridion.local and in another tab to http://authors.tridion.local As far as the browser is concerned, these will be separate sites.


9

The IQ Combined Services (Index and Query) are designed to work with Elastic Search present in the DXD Stack. Index service indexes the data in Elastic Search and Query Service is used to query the data out of the Elastic Search. Both the services operate on the same Elastic Search instance. Currently, Index Service doesn't support OAuth authentication but ...


7

The Content Manager Explorer, starting with SDL Tridion 2013, uses the Core Service for all of its functionality, including authorization. Restarting Tridion Content Manager Service Host on the CMS made the setting work so that the next client browser refresh showed a limited set of folders.


7

Welcome to the Tridion Stack Exchange site. You have done the right thing in asking about Tridion CME security and doing some research before diving in. Tridion security is very flexible and powerful, but this does mean that you can easily tie yourself up in knots if you do not plan properly! The main thing to be aware of is that it is focused around ...


7

I often work with Chrome in Incognito mode or FF in Private Browsing mode. Then it doesn't store the passwords


5

The authentication is done with an API key. This key is set on the Translation settings on the source publication in Tridion. Without this API key it is not possible to setup translation in the CMS server. And I think we can assume the TMS server will not accept requests without an API key.


5

It sort of seems like you have answered your own question here, but anyway... I would use Authors for controlling Rights, and then Marketing Authors (which is a member of Authors) for managing which Publications a User has Author Rights in. Even if a User is a member of Marketing Authors for ALL Publications, it will only see the Publications that ...


5

Update If Peter is correct, my answer makes no sense of course! I will leave it for now until Hiren has confirmed that the group memberships are indeed expanded automatically. Original answer As far as I know, the only way to do this is to go through the group memberships recursively. For example (untested code!!) TrusteeData trustee = (TrusteeData) ...


5

Absolutely Nick, per the documentation To add a Keyword (to a Category or Keyword), you must have Category Management rights and Write permissions for the Category. [login required] Similar applies for editing/deleting keywords also. To move or delete a Keyword, you must have Category Management rights and Delete permissions for the Category. ...


5

The access to items in a folder is controlled by either the folder itself, or by the folder it inherits from. If you have permissions set locally in a child folder that allow access, the user will be able to use those items, even if the settings on the parent folder would make it difficult for them to navigate there. So it's quite common to have - as you ...


4

Detailed description of Roles is documented here. registration user is used only for registering capabilities in discovery service. When setting up topology, you need to use cmuser Reference here For retrieving content (CD side), you should be using cduser Also you can check this on Roles


4

It sounds to me like you are running into the infamous 'loopback' issue that occurs when the local machine name doesn't match the fully-qualified domain name (or indeed the custom host header you use). Try disabling the loopback check by following the directions on this Microsoft KB page: https://support.microsoft.com/en-us/kb/896861


4

To "have" a permission or right, you must either have that permission or right "in your own right"(!) by having the permission or right assigned to your User, or you can get it via your group memberships. Group memberships are transitive, in that if you are a member of A, and A is a member of B which is a member of C, you get C's permissions. It all needs ...


4

From SDL Tridion 2011 SP1 HR1 onwards you could use a BinaryContentProvider. With this extension point you can implement your own logic to handle external URLs on multimedia components. Here you can implement your own logic to authenticate and download the media. This is documented in the TOM.NET API documentation in the IBinaryContentProvider. Also see the ...


3

Rather than changing the Permissions on the Component/Folder, you could consider using the ElevatePrivileges and RestorePrivileges Core Service methods to elevate the user to a System Administrator during that session.


3

The second error is an expected one, you are trying to read the Categories and Keywords node, which isn't an Organizational item, it is just a node in the navigation tree. You can see that in the CME, as there are no properties for that node. So you are also unable to set rights and permissions on that, you have to set these on each Category separately. For ...


3

SDL Tridion does not do its own authentication, that is delegated to IIS. The same thing counts for when you are accessing SDL Tridion through WebDAV, as the WebDAV server also authenticates the user via IIS. After a user is authenticated, SDL Tridion handles authorization based on what is configured for that user. If the logged in user has no read rights ...


3

The only permission needed is translation management rights on one of the target languages - they do not need any permissions on the items in the job. The reasons it mentions you need "one other right" is because TM is an extension of CM. And if you do not have a single CM right then CM will hide the publication from you as it does not see the TM right. One ...


3

As Jan mention before you have to implement the your custom IBinaryContentProvider and add your authentication logic to the method public void WriteContentToStream(Uri uri, Stream outStream) { ... }


2

Group memberships are automatically expanded for the current user. So just call GetCurrentUser() and check if the relevant group is in the GroupMemberships array.


2

Regarding How do I get Chrome (or Firefox) to "forget" my user? If you are clearing your browser history and still you are not prompted for the User Login then please check in the "Saved Password" list and see if your CME address is there; if it is, then remove it from there and choose the option of never save password for this website. If you are using IE,...


2

The screenshot helps a lot in identifying the issue here, it has nothing to do with a timeout really. The issue is a misunderstanding in how the add user dialog works. As documented (http://docs.sdl.com/LiveContent/content/en-US/SDL%20Web-v1/GUID-C5616183-B4F1-4138-B9A7-F8D67692743B): In Step 1 of the wizard, select users to add: Select the value ...


1

The Applicable Actions are not used to drive the authorization logic in the CM Kernel, but only to drive which actions are allowed/disallowed/disabled in the GUI. So, an approach can be to use standard CM Security to restrict access in the most lax manner and then use a Load event handler to modify ApplicableActions so that the GUI can disallow actions even ...


1

You may want to explore below links (Requires Login) SDL Tridion Online Documentation Releted links are below for Access Management: SDL Tridion Online Documentation - Setting rights SDL Tridion Online Documentation - User and group rights and permissions


Only top voted, non community-wiki answers of a minimum length are eligible