Experience Manager Preview with Security Delegation

When rendering preview channels in the Experience Manager, the HST uses a session from the previewuser session pool. In some cases, it is not desirable for the HST previewuser to have read access to all preview documents. Certain preview documents may be restricted to specific CMS editors or authors. You can restrict the previewuser's access to these documents through standard security configuration. For details, see Repository Authorization and Permissions.

To ensure that editors and authors can still preview documents they are authorized to access in the Experience Manager, Bloomreach Content supports Repository Session Security Delegation.

When a CMS editor or author previews the site in the Experience Manager, the system combines the read access of the HST previewuser with the editor's own access. The editor can view all documents readable by the previewuser, plus any additional preview documents they are permitted to access.

Diagram: The diagram illustrates a repository with readable (green dots) and unreadable (red dots) nodes. Two overlapping green-outlined circles represent the Preview Site Session and the CMS Editor Session. Green dots within each circle indicate nodes readable by each session, with an overlap for shared access. A red-outlined area within the CMS Editor Session, labeled as a domain rule extension, excludes LIVE documents and contains a red node, indicating preview-only access for the editor. Red dots outside both session areas represent nodes that remain unreadable.

By default, when rendering a preview channel, the system renders all documents accessible to the HST previewuser and any additional documents the logged-in CMS user can access. To restrict preview rendering to only the documents readable by the HST previewuser, set the cms.preview.security.delegation.enabled property in hst-config.properties to false. In most cases, you do not need to change this default behavior.