1

How would you make portions of Craft available to only people that are "on the domain" and then let the rest of it be public facing? Would you need two instances of craft on 2 servers? One which is accessible only from "inside" and another that the public can access?

Would this entail running Craft on one webserver and the front-end on another? This way the webserver with craft on it is only accessed internally but the front-end can be accessed outside?

edit: I only want CP to be accessed by people who are logged in and on the work network. For security reasons a simple login is not enough.

Matt Stein
  • 4,006
  • 3
  • 26
  • 57
Exziled
  • 293
  • 1
  • 10

3 Answers3

2

The back end of craft (admin log in section or Control Panel) can only be accessed by admins and users that an admin has added. The front end will always be visible to everyone while the backend will be password protected.

If you want separate front end displays for people who have usernames and passwords and those who dont, you could add a front end log in form:

http://buildwithcraft.com/docs/templating/login-form

And display one set of templates for those who are logged in and another for those who arent logged in via conditional statements e.g.

{% if currentUser %} Protected info {% else %} public Info {% endif %}

If this isn't quite the answer you're looking for could you be slightly more specific with what you mean by "on the domain". Describe exactly what you're looking to achieve.

George Dunning
  • 71
  • 4
  • I updated it. By "on the domain" I mean the CP and certain functionalities on the website can only be accessed by those who have the admin password/login AND are accessing it directly from the work network. – Exziled Oct 28 '15 at 14:52
  • Ok so you can definitely create password protection and allow for specific functionalities to those with logins. In the CP this can be further customised in the users permissions sections. Customising functionality directly for your work network however may be problematic. You could try and add some configuration dependent on IP address, possibly in the config.php, but as far as I'm aware there isnt anything built into craft that would give this "out of the box". – George Dunning Oct 28 '15 at 15:27
0

Assuming your network is behind a router that's setup for DHCP that's handing out a block of IP addresses (typically 192.168.xxx.xxx), you could protect pages using craft.request.getIpAddress() and checking that it's within your allowed IP range.

Keep in mind that's not the most secure method in the world given that it's fairly trivial to spoof the IP address headers on a request.

Alternatively, if your network has a central login authority (like an Active Directory server), then you're looking at creating a Craft plugin that authenticates with something like LDAP to provide proper authentication/authorization for areas of your site.

Brad Bell
  • 67,440
  • 6
  • 73
  • 143
  • That's exactly what it is. We use AD here so I'm looking to find a way to validate that they are on this domain and then allow them to log in. I'm very new to craft and all of this so I'm still trying to wrap my head around it and the best way to ask these sorts of questions! – Exziled Oct 28 '15 at 15:39
  • Probably worth reading, then: http://craftcms.stackexchange.com/a/5071/57 – Brad Bell Oct 28 '15 at 16:55
  • I'm surprised Craft doesn't offer up a template variable with just $_SERVER['REMOTE_ADDR']? Just looked at the code and it goes through some hoops to get the "right" IP but if you're on a trusted LAN, you don't need the checks... – RitterKnight Oct 29 '15 at 04:08
  • @RitterKnight We've got it at the PHP level with craft()->request->getUserHostAddress(). No one has ever requested to have it exposed to Twig, though. – Brad Bell Oct 29 '15 at 04:10
  • @Brad: Yeh, probably for good reason... (if you're going to limit via IP and are serious about security, you do it on the web server.) – RitterKnight Oct 29 '15 at 04:18
0

I'm assuming the web server is "local" and sits behind the firewall with the rest of the NAT'd work group? Depending on what pages you need to limit access, you could lock it down at the NAT/server level.

If it were me, I'd do something like companyintranet.whatever.com and use Craft's routing to set up the company only pages (on say a separate structure section). That way, they don't get accidentally mingled in with the rest of the public facing pages. As long as all pages point back to a single CP instance, that's covered on Craft's license.

RitterKnight
  • 6,582
  • 14
  • 24