Skip to main content

Implementing a Secure Media library in Sitecore

Our internal clients wanted us to secure some of their resources stored in the media library so that only authenticated and authorized extranet users are able to view or download them. Our current setup has the following components, I'll simply focus on the 3rd and 4th points:
  1. Sharepoint Workflows on a Sharepoint 2007 Server. This serves as the working repository of the resource owners.
  2. Sitecore Sharepoint Integration Framework. This hooks up Sitecore with the designated document library in Sharepoint for all finalized files/documents
  3. Integration folder in the Media library
  4. Login page to handle the authentication
Create your login page.
You have the option to create your sublayout for this (mostly to control the page contents etc.) or you can just quickly create one and put it in one of your folders in your solution. I normally use CodeFile directive in my pages as we found it easier to maintain this type of setup in the long run. There are plenty of samples of the login functionality in the web. 
The important thing to note when you start coding for your Login page's load event is that you would need to intercept Sitecore's default querystring for the return URL i.e. the "url" querystring.

Setup your media library security
This step assumes that you have already put in place the corresponding Roles on the extranet domain that will be given access to the secured media items.
Configure the folders by providing Read access with Inheritance to the corresponding extranet Roles.
Now, for the folders that would not be made or referenced for public pages, put an explicit Deny on the "extranet\Anonymous" account. Publish your changes.

Caveats
There is a bug in Sitecore that for some reason whenever a protected media file/item is requested, the "url" querystring is stripped even though the SaveRawUrl setting was turned on. Kindly contact your SC Support for a patch they provide regarding this issue.




Labels:

Comments

Post a Comment

Popular posts from this blog

Add Export to File Functionality in Sitecore's Search Options

One of our business users was requesting for a listing of items they've already added and have it available in a format that can be opened in a spreadsheet (Excel). My initial thought was to create a blank aspx page and write all the logic to get the data in the code-behind, run it and save the resulting file to a csv then I'm done. But then it got me to think, it might be a better idea to have this functionality plugged in to Sitecore and made available for everyone to use.  Sitecore Bucket's Search Options fly-out seemed a good candidate for this feature (See image below). So doing some quick readings I got myself in to the "zone" and started implementing this quick and dirty PoC. Just to explain what it actually does. User will basically do a search, ( Note that all search options require some filters or search keyword before any of the options can be used ) clicks the Export to File, it pops up a dialog to confirm the action and executes, after w
7 comments
Read more

Add/Allow a different media URL prefix in Sitecore (aside from tilde ~) in Sitecore 7.0

We recently had a requirement when one of our external vendors required that our media URLs should not include the "~" in the link as their system could not process those correctly. I found a few articles in the web, but most of them would suggest changing the default behavior, i.e. any "new" media item would have the 'new' replacement character though still supporting the tilde "~". Based on the web articles, I started with the following config keys and section: Media.RequestExtension Media.MediaLinkPrefix customHandlers We did not want to change any of the default behaviors, we just needed a way to make Sitecore support the additional URL media prefix. While sifting through the configuration, I chanced upon the following section: <mediaPrefixes>  According to the comment above it: Allows you to configure additional media prefixes (in addition to the prefix defined by the Media.MediaLinkPrefix setting)            The
Post a Comment
Read more

Rich Text Editor (RTE) Stripping Script tags

Ran across an issue today wherein one of our Content Editors was complaining that their page was not working, i.e. some page scripts where not firing. Upon closer inspection, we found out that their content inside their RTE was missing. We added them back but, it just kept getting stripped-off when we close the editor. This did not happen to us before when we were using SC6.5, so this basically smells more like an upgrade issue. I scanned all of the config changes (I kept a log) and found one curious setting:       <setting name="HtmlEditor.RemoveScripts" value="true" /> This setting was by default removing any embedded scripts inside the RTE. Just turn it off in your CM and keep it on in your CD.
Post a Comment
Read more