Commerce Server Catalog Security

Hi All,

I'm working through a Commerce Server implementation where we have multiple business users that for security reasons can only be allowed to see their own catalogs. I'm wondering, is it a better idea to have multiple master catalogs, one for each business user, and if so can we somehow aggregate master catalogs into an uber-catalog? Or can we instead use virtual catalogs, and somehow limit the accessibility of each virtual catalog to only the business users who would be the administrators? Are either of these two options possible?

Thanks!

[771 byte] By [netdirector] at [2008-1-10]
# 1

From security perspective it doesn't matter if you use base catalogs or virtual catalogs. The security of what catalogs a business user has access is done using Azman scopes. When you create a catalog using APIs or Catalog Manager and enabling authorization manager then a scope is created CatalogScope_<CatalogName> and for properties PropertyScope_<PropertyName>. For more info read “Adding Users to the Predefined CatalogEditor Role”.

Good luck,

-Max

MaxAkbar at 2007-10-3 > top of Msdn Tech,Commerce Server,Commerce Server 2007...
# 2

I see. So, this would limit access to the catalogs to only those business users assigned to that particular virtual catalog, and we could still keep an overall master catalog with everything.

Can we also prevent the business users from seeing all but their own catalogs? From a privacy perspective? Or does Catalog Manager display everything by default?

Thank you, Max!

netdirector at 2007-10-3 > top of Msdn Tech,Commerce Server,Commerce Server 2007...
# 3

Yes, by adding the user only to the catalog scope then the user can only modify that catalog and yes the Catalog Manager will only display the catalogs that the user has access.

-Max

MaxAkbar at 2007-10-3 > top of Msdn Tech,Commerce Server,Commerce Server 2007...
# 4

Ok, so that makes sense. What about the underlying products which are added to the catalogs? Can each user only see the products available to their catalog, or do they see the full gamut of products available in the master catalog? In our instance, we want to keep every users products in the master, but that would be too many for an individual user to manage. Effectively, we'd like to limit the product set available to each user to a simpler subset for them to manage and maintain.

Thanks,

- Steve

netdirector at 2007-10-3 > top of Msdn Tech,Commerce Server,Commerce Server 2007...
# 5

If you modify a virtual catalogs property then the API's will over write the base products values. If you want to modify the base then you would have to write custom code to do this.

Regards,

-Max

MaxAkbar at 2007-10-3 > top of Msdn Tech,Commerce Server,Commerce Server 2007...
# 6

Ah. But I could use multiple base catalogs, one for each business user, and then have a "master" virtual catalog that aggregates all the base catalogs. That way I could keep security distinct at the base catalog level, allow multiple virtual catalogs to be created by the business users for their respective base catalog (such as for multi-currency), and then I would need any custom code! Right?

I think I'm finally getting it...

netdirector at 2007-10-3 > top of Msdn Tech,Commerce Server,Commerce Server 2007...
# 7

That would be one way to do it.

-Max

MaxAkbar at 2007-10-3 > top of Msdn Tech,Commerce Server,Commerce Server 2007...