Add a Preview Channel and Restrict Access

Overview

This page describes how to expose a preview channel outside the CMS and restrict access to specific users or roles by configuring authorization at the mount level.

Objective

Configure a preview channel that is accessible only to designated user groups by setting authorization on the mount.

Context

In Bloomreach Content, you can configure authorization at the mount level in the delivery tier. By default, the preview is available in the Channel Manager, but you can also expose it externally by adding an explicit mount configuration.

Example Implementation

Project Setup

1. Create a new project using the Bloomreach Content Maven archetype.
2. Build and run the project.
3. In Essentials, add the News feature to your project.
4. Rebuild and restart the project.
5. In the Console, navigate to /hst:myproject/hst:configurations/hst:default/hst:sitemap/login and change the hst:scheme property from https to http. This change configures the login page to use HTTP in your local development environment. Do not apply this change in production.

The archetype project includes a bootstrap configuration for a single channel (mount), similar to the following:

+ hst:myproject
  + hst:hosts
    + dev-localhost
      + hst:root
copy

The live channel is available at http://localhost:8080/site. To expose a preview channel and its content externally, add a mount with hst:type = preview:

+ hst:myproject
  + hst:hosts
    + dev-localhost
      + hst:root
        + mypreview
          - hst:type = preview 
copy

After this configuration, accessing http://localhost:8080/site/mypreview renders the preview channel, including the preview HST channel configuration and unpublished documents.

Restrict Access to the Preview Channel

To require authentication for the preview channel, add the hst:authenticated property:

+ hst:myproject
  + hst:hosts
    + dev-localhost
      + hst:root
        + mypreview
          - hst:type = preview 
          - hst:authenticated = true
copy

With this configuration, users must authenticate to access the preview channel. The system redirects unauthenticated users to the login screen. However, without specifying hst:roles or hst:users, any authenticated user will receive a 403 Unauthorized error after logging in. For more details, see Delivery Tier Authorization Configuration.

Grant Access to Specific Users

To allow only selected users to access the preview channel, specify the allowed users in the configuration:

+ mypreview
   - hst:type = preview 
   - hst:authenticated = true
   - hst:users = [admin, john]
copy

Only the users admin and john can access the preview channel.

Grant Access to Specific Roles

Granting access by role is more scalable than managing individual users. For example, to allow only users with the staff role to access the preview channel, configure as follows:

+ mypreview
   - hst:type = preview 
   - hst:authenticated = true
   - hst:roles = [staff]
copy

Ensure that users who need preview access are assigned the staff role. This requires additional configuration, as described in AuthenticationProvider Configuration.

Under /hippo:configuration/hippo:userroles, add the following node:

/site.staff:
  jcr:primaryType: hipposys:userrole
  hipposys:system: true
copy

Note that the user role is named site.staff in this example, not just staff. Adjust the configuration as follows in your project's hst-config.properties file:

security.authentication.included.userrole.prefix = site.
security.authentication.strip.included.userrole.prefix = true

This configuration ensures:

1. Only user roles starting with site. are included for authenticated (JCR) users.
2. The site. prefix is removed from included user roles.

Assign the site.staff user role to users or groups who require access to http://localhost:8080/site/mypreview by adding it to their hipposys:userroles property. These users will then be able to access the mypreview mount.