Anonymous role to have editors rights... doesn't work?

Feb 1, 2011 at 9:10 PM

Hi,

I am using BE on a secure site I have built. BE sits in a seperate folder called 'blog' withinin the root of my site folder. Therefore when users log in I want them to be able to navigate to the blog and write a new post without having to login again through BE.

I have gone to Admin panel > Users > Roles and provided Anonymous with the same permssions as 'Editors', but anon still cant't seem to post, nor can access the dashboard and I cant add any widgets either to the side panel.

Any ideas?

Thanks

M

Coordinator
Feb 2, 2011 at 9:56 AM

I think in order to access the control panel, you need to at least be logged in.  So anonymous role probably doesn't work for that.

You might want to consider allowing people to self-register with the new self-registration option in BE 2.0.  On the Settings tab in the control panel, you can turn on self-registration and also select a Role from the dropdown list that users who self-register are automatically assigned to.  Then those people can self-register once, and be tied to a role that you create (or you can assign them to the Editors role).

Feb 2, 2011 at 10:26 AM

BenAmada,.

Thanks for your response. Unfortunately as BE is to be hosted on a secure site I really don't want the users to have to create 2 accounts; one for the main site and the other for BE.

If I could get anonymous role to access the admin panel and create a post that would solve all my problems.

The question is why then can anonymous role inherit Admin or Editors permissions defined, if anon can't actually access the admin panel.

Thanks

 

M

Coordinator
Feb 2, 2011 at 8:36 PM

You can allow unauthenticated users into the control panel.  There's a few small web.config files in the /admin folder and sub-folders.  They are setup to only allow authenticated users to access the pages in those folders.  There's 5 of them in total.

/admin
/admin/Comments
/admin/Extension Manager
/admin/Pages
/admin/Users

Rename (or delete) these web.config files.  If you rename, you can rename them to something like web.config.txt or web.config.exclude.

Untested, but if you rename/delete them, anonymous users should then be able to access the control panel.

Feb 2, 2011 at 9:16 PM

I amended the web.config files to web.config.txt but now when you try and access any of the admin pages, by entering the URL for e.g. dashboard, you get redirected to Default.aspx homepage.

Coordinator
Feb 2, 2011 at 10:39 PM

I tested it and found 2 things that need to be done.

On the Rights page for the Anonymous role, make sure "Access Admin Settings Pages" is checked (top left).  I think by default, even for Editors, it's not checked, so you will probably need to check it and Save.

Second, in the /admin folder is a file named admin.master.cs.  Within it, is OnInit(), with this check:

if (!Security.IsAuthenticated)
{
	this.Response.Redirect(Utils.RelativeWebRoot);
}

That needs to be deleted or commented out.

Coordinator
Feb 2, 2011 at 10:44 PM

Actually, giving the Anonymous role the "Access Admin Settings Pages" right is probably not necessary ... it's only needed if the anonymous user needs to access the Settings tab in the control panel -- which is typically just for admins.  So you can probably leave Access Admin Settings Pages unchecked.

Feb 2, 2011 at 11:14 PM

BenAmada, Thanks for your suggestions i've got it pretty much working now, except for a small bug.

Once I have saved a new post, I get an error message from the Js drop down alert at the top of the page saying "Could not save post: Object reference not set to an instance of an object."

However, if you navigate to the home page the post is there.....

Feb 3, 2011 at 9:32 AM

Hi There,

I Have another aproach for that ....

You dont want that youre users opens two accounts in youre site. I think youre right. But why not configure BE with the same database details of youre main site?

I dont know if it is possible but its only one idea. I say that because i also want do that in a near future.

What you think of that?

Regards,

Feb 3, 2011 at 10:39 AM

Neo,

Thanks for your suggestion, in fact I had already thought of that and was planning on trying that once I got around to implementing the secure login for the main site.... ultimately my last resort.

BenAmada's suggestions have worked well minus this Annoying exception alert I get saying "Could not save post: Object reference not set to an instance of an object." Although as mentioned previously the post does in fact get saved.

It would be useful  if I could find that particular exception code, so I could possible modify/remove, but a search of the entire solution has found nothing.

Feb 3, 2011 at 10:54 AM

Ok max, if one day you found the solution for that minor error post here please, like i also said im gonna make the same on my site.

Regards,

Coordinator
Feb 3, 2011 at 9:56 PM

I found the reason for the error, when you save the post.  If you recall, we renamed the Web.config file in the /admin folder to Web.config.txt (so it would be ignored).  This file is actually needed, but the <authorization> part should be removed.

So you should rename it back to Web.config (drop the .TXT extension), and the contents should look like:

<?xml version="1.0"?>
<configuration>
  <system.web>
    <pages enableSessionState="true" />
  </system.web>
</configuration>
Feb 3, 2011 at 11:01 PM

BenAmada, That worked a treat!!

Thanks for helping me out!

M