Don't miss out Virtual Happy Hour this Friday (April 26).

Try our conversational search powered by Generative AI!

EPiServer.Security.CreatorRole virtual role does not work with inherited ACLs

Found in

EPiServer.CMS.Core 7.5.394.2

Fixed in

EPiServer.CMS.Core 9.0.3

(Or a related package)

Created

Aug 26, 2015

Updated

Jun 09, 2016

Area

CMS Core

State

Closed, Fixed and tested


Description

1. Make sure that CreatorRole is configured for use in EPiServerFramework.config
2. Create page PARENT as user A
3. Create page CHILD as a subpage of PARENT as user B
4. Make sure that CHILD inherits its ACL from PARENT
5. Set up the ACL for PARENT so that only the Creator group can read.
6. Visit CHILD as user B

Expected:

You are allowed to view the page - you are considered to be a member of the Creator group.

Actual:

You get a login prompt - you are not considered to be a member of the Creator group.

1. Explicitly give Creator group read access to CHILD - i.e. don't inherit.
2. Visit CHILD as user B