How does Orchard know that the default user (user created during setup) is an Admin?

Topics: Administration
Jul 2, 2015 at 2:17 PM
In our app I'm extending the logon process as we store membership information in a separate database using another provider. I still need to check if a user logging in is the default user (created during setup).

I check user roles with the following:
var roles = userPart.As<IUserRoles>().Roles;
There are no assigned roles for the default admin user. I also checked the database to be sure and indeed no roles are assigned. The only way I can think that Orchard would know this is that the default user will always be the first record in Orchard_Users_UserPartRecord.

Would this be a correct assumption? If not, how does Orchard know? I can't see any flags or otherwise that would indicate it.
Jul 2, 2015 at 5:24 PM
As a matter of fact, the default account is not an admin, as in "In the Administrator role" as you just found out.
This user account is the Site Owner account and it is defined in the general settings in the dashboard.

When the authorization manager kicks in, it will check for Permissions aggregated from a users' Roles, and also allow anything if the user is the Site Owner.
There is even a specific permission called Permissions.SiteOwner if you want to check if the current user is the Site Owner. Some functionalities which can allow privilege elevation like running scripts or installing modules will check for this one.

My recommendation is that this user account is never used, like the Administrator account on a Windows system, but instead you create a specific account with the correct roles like Admin if necessary.
Jul 2, 2015 at 5:24 PM
Also adding that you can get the name of the Site Owner by loading the current Site content item from IOrchardServices.
Jul 3, 2015 at 8:26 AM
Edited Jul 3, 2015 at 8:29 AM
Thanks for the detailed response.

Should the site owner account always be kept? Would deleting it and creating a new account and assigning it highest privileges suffice, or is their anything else other than being defined in the dashboard general settings that makes this account different?
Jul 4, 2015 at 1:35 AM
Not sure if the Site Owner account can ever be deleted. It has to be there.
You cannot assign the privileges of a Site Owner to anyone who's not set to be a ... Site Owner. Like Sebastien wrote - Site Owner has a set of unique permissions that cannot be assigned to other users. So this account has to be there, although it can have some non-guessable, random password nobody will know and use.
Jul 4, 2015 at 5:50 AM
You could disable the site owner user account, but you shouldn't delete it.