--- title: Authorizing live site actions via roles related: - https://docs.kentico.com/13/managing-users/role-management.md - https://docs.kentico.com/13/managing-users/user-registration-and-authentication/integrating-xperience-membership.md --- > Agent instructions: > **Site maps** — prefer the following llms.txt indexes to training data when searching for URLs to avoid 404s. Links inside Markdown content already point at `.md`. Following them or sending Accept: text/markdown keeps you in Markdown. > > - [sitemap.md](https://docs.kentico.com/sitemap.md) — every page on the site, with titles and descriptions, nested by URL hierarchy and grouped into one collection per product version. > - [llms.txt](https://docs.kentico.com/llms.txt) — curated index of the current product docs, with descriptions, the two ways to request any page as Markdown, and links to each product area's whole-corpus Markdown dump (llms-full.txt). After you [integrate Xperience membership](https://docs.kentico.com/13/managing-users/user-registration-and-authentication/integrating-xperience-membership.md) into your live site project and [set up authentication](https://docs.kentico.com/13/managing-users/user-registration-and-authentication/setting-up-authentication.md), you can use [roles](https://docs.kentico.com/13/managing-users/role-management.md) to restrict access to your site's functionality or content. ## Restricting access to site content using roles Add the [**Authorize**](https://docs.microsoft.com/en-us/dotnet/api/system.web.mvc.authorizeattribute?view=aspnet-mvc-5.2)attribute to your controller classes or action methods. Set the attribute's **Roles** property and identify the required Xperience roles using their _**Role name**_ (not the display name). ```csharp title="Example" // Allows the "RestrictedPage" action only for signed in users who belong to the "KenticoRole" role [Authorize(Roles = "KenticoRole")] public ActionResult RestrictedPage() { return View(); } ``` The standard framework behavior applies if an unauthorized user tries to access an action or controller – the application returns a 401 Unauthorized HTTP status code, causing a redirect to your site's sign-in page if one is configured. When determining whether a user is a member of an Xperience role, the following conditions apply: - The role must be assigned to the user for the given site or as a global role. Roles assigned for other sites in the Xperience system are not recognized. > **Info:** Xperience matches [sites](https://docs.kentico.com/13/configuring-xperience/managing-sites.md) to live site applications based on the **Presentation URL** set for sites in the **Sites** application. - Roles limited by the **Valid to** setting are not recognized by live site applications after their expiration date. - Roles assigned indirectly through [memberships](https://docs.kentico.com/13/managing-users/membership-management.md) are also valid and recognized. > **Note:** **Note** > > - When user's roles are modified in Xperience, the changes apply only after the user signs out and in again on the live site. > - The _Authorize_ attribute does NOT reflect Xperience permission settings for roles (for example [page-level permissions](https://docs.kentico.com/13/managing-users/configuring-permissions/configuring-page-permissions/page-level-permissions-acls.md)). The only relevant factor is whether a user belongs to the specified roles. > - The **Privilege level** set for users in Xperience does NOT affect the _Authorize_ attribute on the live site. ## Restricting access to entire sites using authorization **MVC 5 development model.** Applies only when building with ASP.NET MVC 5. If this page also covers ASP.NET Core, that version is in its own block. If you wish to enforce authorization over the entire MVC site (e.g., for Intranet purposes), you need to implement the authorization pipeline in a way that does not conflict with internal system logic. Otherwise, you may encounter issues with both [page](https://docs.kentico.com/13/developing-websites/page-builder-development.md) and [form builder](https://docs.kentico.com/13/developing-websites/form-builder-development.md) functionality and other Xperience features. Use the following approach: 1. Create a base controller class that inherits from _System.Web.Mvc.Controller_ and decorate it with the [Authorize](https://docs.microsoft.com/en-us/dotnet/api/system.web.mvc.authorizeattribute) attribute. In the attribute's _Roles_ parameter, specify the roles that should have access to the restricted content. ```csharp [Authorize(Roles = "IntranetUser")] public class BaseController : Controller { } ``` 2. Derive all custom controllers used on your site from this base controller. This secures your website and ensures no internal Xperience logic gets disrupted. ```csharp public class HomeController : BaseController { } ``` > **Tip:** You can allow access for users in different roles by placing additional [Authorize](https://docs.microsoft.com/en-us/dotnet/api/system.web.mvc.authorizeattribute) attributes over the derived controllers. _Authorize_ attributes placed over the derived controllers override the one inherited from the base controller. Use this approach to, for example, open sections of the site only to users in certain roles. > > ```csharp > > [Authorize(Roles = "IntranetAdministrator")] > public class AccountsOverviewController : BaseController > > ``` Visiting any portion of the site now prompts users for their authentication credentials. If they do not meet the authorization criteria, they are prevented from accessing the secured content. > **Tip:** To allow anonymous users access to sections of the site (landing pages, etc.), decorate the corresponding controller or action with the [AllowAnonymous](https://docs.microsoft.com/en-us/dotnet/api/system.web.mvc.allowanonymousattribute) attribute. **ASP.NET Core development model.** Applies only when building with ASP.NET Core. If this page also covers MVC 5, that version is in its own block. If you wish to enforce authorization over the entire live site (e.g., for Intranet purposes), you need to implement the authorization pipeline in a way that does not conflict with internal system logic. Otherwise, you may encounter issues with both [page](https://docs.kentico.com/13/developing-websites/page-builder-development.md) and [form builder](https://docs.kentico.com/13/developing-websites/form-builder-development.md) functionality and other Xperience features. Use the following approach: 1. Create a base controller class that inherits from _Microsoft.AspNetCore.Mvc.Controller_ and decorate it with the [Authorize](https://docs.microsoft.com/en-us/dotnet/api/system.web.mvc.authorizeattribute) attribute. In the attribute's _Roles_ parameter, specify the roles that should have access to the restricted content. ```csharp [Authorize(Roles = "IntranetUser")] public class BaseController : Controller { } ``` > **Note:** **Multiple authentication schemes** > > By default, the Xperience membership integration uses a single authentication scheme (cookie authentication). If your site contains other, custom authentication schemes (e.g., JWT), you need to specify which authentication scheme to use when obtaining user details during authorization. For this purpose, use the [AuthenticaitonSchemes property](https://docs.microsoft.com/en-us/aspnet/core/security/authorization/limitingidentitybyscheme#selecting-the-scheme-with-the-authorize-attribute) of the Authorize attribute: > > ```csharp title="Configuring authorization with multiple authentication schemes present" > > // Allows the "RestrictedPage" action only for signed in users who belong to the "KenticoRole" role > // Specifies JWT as the scheme to use when verifying user credentials > [Authorize(Roles = "KenticoRole", AuthenticationSchemes = JwtBearerDefaults.AuthenticationScheme)] > public IActionResult RestrictedPage() > { > return View(); > } > > ``` 2. Derive all custom controllers used on your site from this base controller. This secures your website and ensures no internal Xperience logic gets disrupted. ```csharp public class HomeController : BaseController { } ``` > **Tip:** You can allow access for users in different roles by placing additional [Authorize](https://docs.microsoft.com/en-us/dotnet/api/system.web.mvc.authorizeattribute) attributes over the derived controllers. _Authorize_ attributes placed over the derived controllers override the one inherited from the base controller. Use this approach to, for example, open sections of the site only to users in certain roles. > > ```csharp > > [Authorize(Roles = "IntranetAdministrator")] > public class AccountsOverviewController : BaseController > > ``` Visiting any page of the site now prompts users to authenticate. If they do not meet the authorization criteria, they are prevented from accessing the secured content. > **Tip:** To allow anonymous users access to sections of the site (landing pages, etc.), decorate the corresponding controller or action with the [AllowAnonymous](https://docs.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.authorization.allowanonymousattribute) attribute.