---
title: Authorization and authentication
slug: commerce-connect-14/docs/authorization-and-authentication
docTags: 
createdAt: 2026-07-23T10:25:32.999Z
---

The authentication in Optimizely Commerce Connect and Optimizely Content Management System (CMS) is based on the [ASP.NET Core built-in framework for users and roles](https://docs.microsoft.com/en-us/aspnet/core/security/?view=aspnetcore-5.0). Optimizely CMS uses a standard API that makes it easy to create your own provider for any type of user database and third-party providers.

In addition, the Optimizely Commerce Connect sample site has several predefined users, groups, and roles for managing content and administering commerce tasks.

## Terminology

The system uses authentication and authorization to identify users and user groups, and determine what they are allowed to do. Here are common terms used in this context:

- **Authentication** – The process of identifying a user. Typically done with a username and password.
- **Authorization** – The process of determining actions a user is allowed to perform.

## Administer security and access rights

When you administer access rights, use the following distinct components, which are loosely tied together. The `EPiServer.CMS.UI.AspNetIdentity` implements and registers the `UIUserProvider`, `UIRoleProvider`, `UISignInManager` and `SecurityEntity` provider in the container.

- **Users** – Delivered by the current `UIUserProvider`.
- **Roles** – Delivered by the current `UIRoleProvider` and the virtual roles.
- **Access control lists** (ACLs)

An **ACL** is a list of `SecurityEntity` classes and an access level. The security entity is a name and information stating whether the name represents a role or a user. A security entity in an ACL is not affected by changes in the `UIUserProvider` or `UIRoleProvider` implementations. So if you delete a role and then look at an ACL that had an access entry for this role, it still appears in the ACL.

## Commerce Connect-specific virtual roles

Along with the default Optimizely CMS groups (WebAdmins, WebEditors, and so on), Commerce Connect has virtual roles that you can use to control access and visibility to parts of the user interface.

- **BusinessFoundations** – Access to the **BusinessFoundations** interface.
- **CatalogIndexing** – Access to the **Catalog** Indexing page.
- **CatalogManagers** – Access to the **Catalogs** user interface.
- **CommerceAdmins** – Access to all parts of Commerce Connect except **Administration** and **CMS Admin** page.
- **Countries** – Access to the **Countries** page.
- **CustomerManagers** – Access to the **Customer** interface.
- **CustomerServiceRepresentatives** – Access to the **Order management** page.
- **Dashboard** – Access to the **Dashboard** page.
- **Dictionaries** – Access to the **Dictionaries** page.
- **MarketingManagers** – Access to the **Marketing** user interface.
- **Markets** – Access to the **Market** page.
- **PaymentMethods** – Access to the **Payments** page.
- **ReportManagers** – Access to the **Report** page.
- **ShippingMethods** – Access to the **Shipping** interface.
- **Taxes** – Access to the **Taxes** interface.
- **Warehouses** – Access to the **Warehouse** page.

The virtual roles must be added to `appsettings.json`. For example, see this configuration.

```javascript
"EPiServer": {
  "Cms": {
 	 "VirtualRole": {
    "Roles": {
      "CatalogManagers": {},
      "CustomerManagers": {}
    }
 	 }
  }   
```

:::hint{type="info"}
**Note**
MarketingManagers also have access to the CMS editor by default. To restrict this group's ability to edit content, limit access through **Admin** > **Set Access Rights**. Grant **Read** access to **MarketingManagers**.
:::

To add a role, add a user to role, or check if a user is assigned to a role, you can use `UIRoleProvider`.

```csharp
_roleProvider.CreateRoleAsync(roleName);
    _roleProvider.AddUserToRoleAsync(username, roleName);
    var userRoles = _roleProvider.GetRolesForUserAsync(userName);
```