Topics

All topics

Development

Check and demand permissions
Development

This article contains
NEW TO SITEFINITY?

Checking permission is checking whether an action is granted.

Demanding permission is verifying that an action can be executed. If the user is not allowed to perform the action, an exception of type Telerik.Sitefinity.Security.SecurityDemandFailException is thrown.

Check whether permission set is supported

To check whether a permission set is supported for secured object, you use the IsPermissionSetSupported method of the secured object. 

The following example checks whether the blog permissions set is supported. First, you initialize the blogs manager. Then, you get the security root using GetSecurityRoot. Finally, you call IsPermissionSetSupported passing BlogsPermissions.Sets.Blog.SetName.

using Telerik.Sitefinity.Modules.Blogs;
using Telerik.Sitefinity.Security;
using Telerik.Sitefinity.Security.Model;
namespace SitefinityWebApp
{
public class PermissionSetSupport
{
public bool CheckIfPermissionSetIsSupported()
{
BlogsManager blogsManager = BlogsManager.GetManager();
ISecuredObject securedObject = blogsManager.GetSecurityRoot(false);
bool isSetSupported = securedObject.IsPermissionSetSupported(BlogsPermissions.Sets.Blog.SetName);
return isSetSupported;
}
}
}
view raw PermissionSetSupport.cs hosted with ❤ by GitHub

Get all active permissions

The Permissions property of the secured item contains permissions that are part of the permissions inheritance. When the inheritance is broken and then restored, Permissions is used. 

Sitefinity CMS allows you to get the permissions that are relevant to the current state of the secured object by using the GetActivePermissions extension method of ISecuredObject.

using System.Linq;
using Telerik.Sitefinity.Modules.Blogs;
using Telerik.Sitefinity.Security;
using Telerik.Sitefinity.Security.Model;
namespace SitefinityWebApp
{
public class GetActivePermissions
{
public IQueryable GetActivePermissionsMethod()
{
BlogsManager blogsManager = BlogsManager.GetManager();
ISecuredObject securedObject = blogsManager.GetSecurityRoot(false);
IQueryable<Telerik.Sitefinity.Security.Model.Permission> permissions = securedObject.GetActivePermissions();
return permissions;
}
}
}
view raw GetActivePermissions.cs hosted with ❤ by GitHub

Check permissions
  • To check whether permissions are granted, you use the IsGranted method of ISecuredObject. 
  • To check whether permissions are denied, you use the IsDenied method of ISecuredObject. 
  • To demand permissions, you use the Demand method of ISecuredObject. 

The following example checks whether the current user can delete blogs. First, you initialize the blogs manager. Then, you get the security root using GetSecurityRoot. Finally, you call IsGranted passing the permissions set and action names.

Check whether current user can delete blogs

using System;
using Telerik.Sitefinity.Configuration;
using Telerik.Sitefinity.Modules.Blogs;
using Telerik.Sitefinity.Security;
using Telerik.Sitefinity.Security.Configuration;
using Telerik.Sitefinity.Security.Model;
namespace SitefinityWebApp
{
public class CheckPermissionsCurrentUser
{
public static bool CheckPermissionsUser(string userName)
{
BlogsManager blogsManager = BlogsManager.GetManager();
UserManager usersManager = UserManager.GetManager();
SecurityConfig secConfig = Config.Get<SecurityConfig>();
Telerik.Sitefinity.Security.Configuration.Permission blogsPermSet = secConfig.Permissions[BlogsPermissions.Sets.Blog.SetName];
int actionsMask = blogsPermSet.Actions[BlogsPermissions.Sets.Blog.Delete].Value;
ISecuredObject securedObject = blogsManager.GetSecurityRoot(false);
Guid[] users = new Guid[] { usersManager.GetUser(userName).Id };
bool isGranted = securedObject.IsGranted(BlogsPermissions.Sets.Blog.SetName, users, actionsMask);
return securedObject.IsGranted(BlogsPermissions.Sets.Blog.SetName, users, actionsMask);
}
}
}
view raw CheckPermissionsCurrentUser.cs hosted with ❤ by GitHub

Sitefinity CMS allows you to check whether permissions are granted for specific user.  The following example checks whether the specified user can create and delete blogs. First, you initialize the blogs and user managers. Then, you get the security configuration and the blog permissions set. For more information, see For developers: Permissions configuration. Then, you create the bit mask by performing bitwise OR between the values of create and delete blog actions. For more information, see For developers: Permissions API. You get the blogs data provider security root. Finally, to check whether the specified user is granted the permissions, you use the IsGranted passing the permissions set name, the ID of the user and the actions mask. 

Check whether permissions are denied to a specific user

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
using Telerik.Sitefinity.Configuration;
using Telerik.Sitefinity.Modules.Blogs;
using Telerik.Sitefinity.Security;
using Telerik.Sitefinity.Security.Configuration;
using Telerik.Sitefinity.Security.Model;
namespace Telerik.Sitefinity.Documentation.CodeSnippets.DeepDive.Security.Permissions.CheckForPermissionsForUser
{
public partial class PermissionsApiSnippets
{
public static bool CheckForPermissionsForUser(string userName)
{
BlogsManager blogsManager = BlogsManager.GetManager();
UserManager usersManager = UserManager.GetManager();
SecurityConfig secConfig = Config.Get<SecurityConfig>();
Telerik.Sitefinity.Security.Configuration.Permission blogsPermSet = secConfig.Permissions[BlogsPermissions.Sets.Blog.SetName];
int actionsMask =
blogsPermSet.Actions[BlogsPermissions.Sets.Blog.Create].Value |
blogsPermSet.Actions[BlogsPermissions.Sets.Blog.Delete].Value;
ISecuredObject securedObject = blogsManager.GetSecurityRoot(false);
Guid[] users = new Guid[] { usersManager.GetUser(userName).Id };
return securedObject.IsGranted(BlogsPermissions.Sets.Blog.SetName, users, actionsMask);
}
}
}
view raw CheckForPermissionsForUser.cs hosted with ❤ by GitHub

The same code can be used for checking whether permissions are denied and demanding by using IsDenied and Demand.

Sitefinity CMS also allows you to check whether permissions are granted for dynamic content. 

Check whether permissions are granted for dynamic types

using System;
using System.Linq;
using Telerik.Sitefinity.Configuration;
using Telerik.Sitefinity.DynamicModules;
using Telerik.Sitefinity.Security;
using Telerik.Sitefinity.Security.Claims;
using Telerik.Sitefinity.Security.Configuration;
namespace SitefinityWebApp
{
public class CheckPermissionForDynamicType
{
public bool CheckUserPermissionsForDynamicType(Type pressReleaseType, Guid itemId)
{
DynamicModuleManager dynamicModuleManager = DynamicModuleManager.GetManager();
var item = dynamicModuleManager.GetDataItem(pressReleaseType, itemId);
string permissionsSetName = "General";
SecurityConfig secConfig = Config.Get<SecurityConfig>();
// get the permissions set
Telerik.Sitefinity.Security.Configuration.Permission generalPermSet = secConfig.Permissions[permissionsSetName];
// get view permission action mask
int actionsMask = generalPermSet.Actions["View"].Value;
// get current user id, else use "everyone"
Guid principalId = ClaimsManager.GetCurrentUserId();
if (principalId == Guid.Empty)
{
// you can hardcode the id for better performance
// from the security config
// <role id="32f565b9-f8a0-4836-96cd-2a3657cc5daf" name="Everyone" />
principalId = new Guid("32f565b9-f8a0-4836-96cd-2a3657cc5daf");
var everyoneId = secConfig.ApplicationRoles.Values.Where(r => r.Name == "Everyone").First().Id;
}
Guid[] principals = new Guid[] { principalId };
bool isGranted = item.IsGranted(permissionsSetName, principals, actionsMask);
return isGranted;
}
}
}
view raw CheckPermissionForDynamicType.cs hosted with ❤ by GitHub

Want to learn more?

Increase your Sitefinity skills by signing up for our free trainings. Get Sitefinity-certified at Progress Education Community to boost your credentials.

Get started with Integration Hub | Sitefinity Cloud | Sitefinity SaaS

This free lesson teaches administrators, marketers, and other business professionals how to use the Integration hub service to create automated workflows between Sitefinity and other business systems.

Web Security for Sitefinity Administrators

This free lesson teaches administrators the basics about protecting yor Sitefinity instance and its sites from external threats. Configure HTTPS, SSL, allow lists for trusted sites, and cookie security, among others.

Foundations of Sitefinity ASP.NET Core Development

The free on-demand video course teaches developers how to use Sitefinity .NET Core and leverage its decoupled architecture and new way of coding against the platform.

Was this article helpful?

Next article

Grant and deny permissions