Question

In my Sitecore site I need a page viewable only to authorized users. I have allowed read and inheritance for the role I want and denied read and inheritance for extranet\anonymous. The item is part of a group where the other items are not protected. This list of items is databound and rendered as navigation links on the site.

var id = new Sitecore.Data.ID("<guid here>");
var item = Sitecore.Context.Database.GetItem(id);

// protected item is not part of Children collection when user is anon.
this.navrepeater.DataSource = item.Children; 
this.navrepeater.DataBind();

When I’m logged in, a link to the protected item is shown and I can view the page. When I’m not logged in (operating as extranet\anonymous), the link is not shown at all. When I go the url directly I get a 403 error. In my web.config I have set the loginPage attribute on the site node but I don’t get redirected.

<site name="mysite" ... loginpage="/login.aspx" />

So,

1. How do I display the link to the protected page for anonymous users

2. How do get sitecore to redirect the user to the login page when needed

Answer 1

1) You can wrap the code that retrieves the items for the nav links in the SecurityDisabler to show the link even if they can’t view the page:

using(new SecurityDisabler()) { // this bypasses any security
  this.navrepeater.DataSource = item.GetChildren(); // note that the Children property is deprecated, use the GetChildren() method instead
}

2) If you make your page’s code behind class inherit from Sitecore.Shell.Web.UI.SecurePage it will handle the check and redirect to the login page for you. No coding needed.