Authorization and authentication
The authentication in Optimizely Commerce Connect and Optimizely Content Management System (CMS) is based on the ASP.NET Core built-in framework for users and roles. Optimizely CMS uses a standard API that makes it easy to create your own provider for any type of user database and third-party providers.
In addition, the Optimizely Commerce Connect sample site has several predefined users, groups, and roles for managing content and administering commerce tasks.
Terminology
The system uses authentication and authorization to identify users and user groups, and determine what they are allowed to do. Here are common terms used in this context:
- Authentication – The process of identifying a user. Typically done with a username and password.
- Authorization – The process of determining actions a user is allowed to perform.
Administer security and access rights
When you administer access rights, use the following distinct components, which are loosely tied together. The EPiServer.CMS.UI.AspNetIdentity implements and registers the UIUserProvider, UIRoleProvider, UISignInManager and SecurityEntity provider in the container.
- Users – Delivered by the current UIUserProvider.
- Roles – Delivered by the current UIRoleProvider and the virtual roles.
- Access control lists (ACLs)
An ACL is a list of SecurityEntity classes and an access level. The security entity is a name and information stating whether the name represents a role or a user. A security entity in an ACL is not affected by changes in the UIUserProvider or UIRoleProvider implementations. So if you delete a role and then look at an ACL that had an access entry for this role, it still appears in the ACL.
Commerce Connect-specific virtual roles
Along with the default Optimizely CMS groups (WebAdmins, WebEditors, and so on), Commerce Connect has virtual roles that you can use to control access and visibility to parts of the user interface.
- BusinessFoundations – Access to the BusinessFoundations interface.
- CatalogIndexing – Access to the Catalog Indexing page.
- CatalogManagers – Access to the Catalogs user interface.
- CommerceAdmins – Access to all parts of Commerce Connect except Administration and CMS Admin page.
- Countries – Access to the Countries page.
- CustomerManagers – Access to the Customer interface.
- CustomerServiceRepresentatives – Access to the Order management page.
- Dashboard – Access to the Dashboard page.
- Dictionaries – Access to the Dictionaries page.
- MarketingManagers – Access to the Marketing user interface.
- Markets – Access to the Market page.
- PaymentMethods – Access to the Payments page.
- ReportManagers – Access to the Report page.
- ShippingMethods – Access to the Shipping interface.
- Taxes – Access to the Taxes interface.
- Warehouses – Access to the Warehouse page.
The virtual roles must be added to appsettings.json. For example, see this configuration.
"EPiServer": {
"Cms": {
"VirtualRole": {
"Roles": {
"CatalogManagers": {},
"CustomerManagers": {}
}
}
} Note MarketingManagers also have access to the CMS editor by default. To restrict this group's ability to edit content, limit access through Admin > Set Access Rights. Grant Read access to MarketingManagers.
To add a role, add a user to role, or check if a user is assigned to a role, you can use UIRoleProvider.
_roleProvider.CreateRoleAsync(roleName);
_roleProvider.AddUserToRoleAsync(username, roleName);
var userRoles = _roleProvider.GetRolesForUserAsync(userName);