Combination of roles in Episerver

Question

I have a site where our customers log in to see their own data. Each customer must only see their own data (of course), and different users will have access to different pages within one customer. In addition - the editors must see all data.

I want to set up the access rights based on roles to determine which customer that the user is member of, and what pages the user can access.

Groups:

• Customer1Role
• Customer2Role
• TicketViewerRole
• ChangeRequestRole

Users:

• Cust1_LowLevelUser. Roles: Customer1Role, TicketViewerRole
• Cust1_HighLevelUser Roles: Customer1Role, TicketViewRole, ChangeRequestRole
• Cust2_LowLevelUser. Roles: Customer2Role, TicketViewerRole
• Cust2_HighLevelUser Roles: Customer2Role, TicketViewRole, ChangeRequestRole

Page structure

We have created a page tree where each customer has its own "root page" with access only to their respective role. Below that node we create instances of the data specific pages, which have their access rights based on user roles as well as the customer role.

Customer1 (Customer1Role)
  |--TicketsForCust1 (Customer1Role, TicketViewerRole)
  |--ChangeRequestsForCust1 (Customer1Role, ChangeRequestRole)
Customer2 (Customer2Role)
  |--TicketsForCust2 (Customer2Role, TicketViewerRole)
  |--ChangeRequestsForCust2 (Customer2Role, ChangeRequestRole)

Burning question:

How do we prevent user Cust2_HighLevelUser from seeing ChangeRequestsForCust1?

EPiServer only checks if any role is sufficient for granting access, and since the user belongs to ChangeRequestRole, they will be granted access, regardless of the customer specific role. Is it possible to make EPiServer check BOTH the customer role, and the page role?

Or do I have to look at this from another view? Please let me know if you have run into this and solved it in another way.

Sorry, long post, but hopefully I get my point across.

Answer 1

There is no Deny flag in the access rights model so you need to code it yourself with that role structure.

Add code to your template base class that denies access and for the PageTree control you can do something like this:

protected void NavSubPageTreeFilter(object sender, EPiServer.Filters.FilterEventArgs e)
{
    for (int i = e.Pages.Count - 1; i > -1; i--)
    {
        PageData pd = e.Pages[i];

        if (yourUser.IsInRole("blabla") && ... etc)
        {
            e.Pages.RemoveAt(i);
        }
    }
}