An intranet is a private network so what public people can see it?

What kind of authentication are you using? The standard db authentication, or Windows or LDAP?

There is no way the feeds are going to work unless the blog is on a page where "All Users" can view it. "Authenticated Users" is a role just like any other role, users are added to that role automatically.

"All Users" is not really a role, it means no role is required.

RSS feeds are for publishing content to the public, they are not designed for role based security. 

Best,

Joe

So there are users on your local network that you don't want to be able to see these blog posts/news items?

The Blog itself can be on a private page and users in the role can see the blog on the page, but the feeds are a different story, RSS was not designed for that scenario. The only way I can think of it working is if the feed is being requested by the user's browser like some client side javascript feed reader, then the request for the feed is coming from the authenticate duser and has his cookies in the request headers.Maybe some kind of javscript widget thing like that exists and could be pasted into the source of an html module with the url to the feed.

But a server side feed aggregator that makes server side web requests is a tougher nut to crack to make an authenticated request. I'll do a little research on it and see if any good ideas come to mind.

Best,

Joe

Hi,

The feed does come from the associated rss.aspx page but it currently enforces the page security so it matters who is requesting it.

I will implement this for the next release so that the feed manager inspects the feed url and if its an internal url it will append a guid it reads from Web.config/user.config to the url. Then in the blog feed page I will look for this guid in the url and if it matches the one it looks up from the same config file it will bypass page security. If no guid is configured in the config file or no guid is passed in the url it will enforce the page permissions. If you had replied sooner I would have got it into the release I made yesterday ;-)  but not to worry we are on short release cycles.

The other stuff cecheto requested is more problematic and a lot more work. I mean I can easily add a module setting where a blog could make its feed public even if its on a private page but the problem is the feed links back to the blog and the user clicking it would get an access denied page. I'm not going to implement some complex solution for this with a separate blog viewer. Its an uncommon use case and there are much higher value things I need to work on.

Best,

Joe

Hi Derek,

fyi, this feature is in the new 2.3.1.5 release.

You can add this to your user.config

<add key="InternalFeedSecurityBypassKey" value="3B05C70F-8399-421B-8FDE-CAABB7811779" />

just an example guid though, generate your own either in sql using SELECT newid() or in .NET using Guid.NewGuid().ToString()

This should allow the feed manager to consume the feed of a blog on a protected page albeit with the caveats I mentioned before. You could change it frequently too if you feel your network might have been exposed to unwanted packet sniffing.

Best,

Joe

Hi Derek,

Yes as indicated in my previous post  I implemented this feature (just for you actually) in the 2.3.1.5 release, so it is also included in the latest release.

Best,

Joe

Hi Joe,

Does this require anything to be added to the feed url the Feed Manager uses for individual "protected" feeds.

I never recommend using RSS on protected pages but I have a customer doing it anyway and he is having issues with the Feed Manager not picking up the feeds so I am trying to help him.

Thanks,
Joe D.

Hi Joe,

That's what I thought. I have the setting in place in the user.config and the Feed Manager worked immediately afterwards but about an hour or so later, I checked it and I was getting the "this feed is not available" error on multiple feeds.

The general structure of the site is:

1. Public Pages
2. Intranet
   1. Projects
      1. Project 1
      2. Project 2
   2. Other Intranet
   3. Other Intranet

The "Intranet" page and all child pages are secured by roles (I know it is not the correct use of the term 'Intranet' but they are using it). The individual Project pages (there are like 8 of them) have blog instances on them and the Projects page has a Feed Manager on it. Before I set the InternalFeedSecurityBypassKey in the user.config, the blogs' RSS feeds came through sporadically but after a period of time a couple of them show in the Feed Manager with "this feed is not available" and the rest do not show at all. After setting the Bypass Key, all of the feeds worked but then after an hour or so the Feed Manager exhibited the same behavior as before.

Not sure if this is going to be possible. What do you think?

Thanks,
Joe D.