Ah: that means that everybody can see any “subsite”, but edit it regarding the policies ?
With the NodeTreePrivilege changing protected nodes is intercepted at the server-side. In addition those nodes won’t appear in the navigate component.
If you navigate to a (document) node you don’t have access to the inspector won’t show any editors
Then I don’t fully understand the remark of @aertmann: "it still allows you to go into any site"
Via the URL then ?
@tbrodard I think what Aske meant is that you still can log into the backend through a site you don’t have access to by appending /neos to the URL. But you’ll then only see the tree of your site, so this might not be a problem for you. I’d say: just give it a try and see whether it works for you.
Just to give a feedback and also to thank you 
everything is working fine with your suggestions !
1 Like
BUMP
I think this is still a very important feature for Multisites. In the User Administration module, one should be able to dynamically add the starting point(s) in the page tree for the user. Has there been any progress in the meantime? I would love to contribute, but I have no clue where to start as I am not really into Flow.
By the way, it also happened to me that the NodeTreePrivilege only grants or revokes WRITE access no nodes … sites and nodes are still visible in the page tree or Content module.
This is a related thread: Project proposal: Introduce parameterized roles
Hi Daniel,
I recently made a PR which also goes into this direction as it allows to check privileges of a user together with nodes based on a users property: https://github.com/neos/neos-development-collection/pull/1661
Hi Daniel,
I recently implemented multi-site access restrictions for two multi-site setups and have a write-up on my to do list to show how. However it doesn’t include a way to dynamically select starting points, but I believe something like that would be implemented fairly easily.
1 Like
Thank you, both sounds good. I think this is a really important step for Neos and bigger website projects.
Hi @danielkestler,
Took a while to get around to it as it was quite a task to put into a easily digestible format, sorry about that.
To chime in here: it works like a charm, the AssetConstraints package has been updated for Neos 3.x by now and we packaged Aske’s solution into two small packages to help with setting up such a site.
The packages are up on Packagist already and you might be able to find them… but before doing a “proper” announcement I am giving the customer (think: sponsor) a chance to try them and give feedback. Stay tuned…
1 Like
Hello everyone,
I continue in this topic: is it possible to have references in one site from content elements from another site ?
It seem’s I’ve read it somewhere, but with testing on a 3.x multisite, it seems that it’s not possible.
Or do it need some configuration anywhere ?
If I understand your question correctly, yes it’s possible, assuming the user can see what you want to render for them. In fusion I do it with test = ${q(site).parent()} so test will be the root of all sites and you can then do .find() to get what you need.
In PHP I think you can do it with context, but don’t remember exactly how.
And here is a NodeType I used to reference content across all sites:
'Vendor.Site:CrossSiteReferece':
superTypes:
'Neos.NodeTypes:Page': true
childNodes:
main: ~
ui:
label: 'Content Reference'
icon: 'icon-share-alt'
position: 210
properties:
'target':
type: reference
ui:
label: 'Target content'
inspector:
group: document
editorOptions:
nodeTypes: ['Neos.NodeType:Page'] # This is the node type you want to reference
startingPoint: '/' # This is the catch, it starts from the root
allowEmpty: falseThat’s a very nice and promising article @aertmann, thank you ! I will most probably go through it in practice since I have a use case for users in dynamic multisites.
What do you mean that your approach only supports Neos 2.x ? What would cause compatibility problems in Neos 3.x ? You mentioned to ask you or @bwaidelich about it, so that’s what I’m doing now 
Also, @kdambekalns, I would be very interested in those packages, where can I find them ?
UPDATE:
The mentioned packages are probably the following:
As noted above, they are not “officially announced” yet, I’m posting the links in order to be able to find them again later.
Thank you for sharing and thanks @christianm for helping me find them !
Yeah, sorry… Said packages seem to work just fine, I just forgot to add them here. Glad you found them!
When using the package flownative/neos-multisitekickstarter i cannot log in to Site B (Neos 3.3) and instead get the following error:
Call to a member function hasActiveDomains() on null
Exception Code 0
Exception Type Error
Thrown in File Data/Temporary/Development/Cache/Code/Flow_Object_Classes/Neos_Neos_Service_LinkingService.php
Line 301
Original File Packages/Application/Neos.Neos/Classes/Service/LinkingService.php
Line 301 is: if ($site->hasActiveDomains()) {
Before you have the following variables (when logging in to Site B to the home page (/sites/site-b):
-
$siteNode: Instance of NodeInterface with the correct context path (/sites/site-b@user-siteb) -
$resolvedNode: Instance of NodeInterface with context path of site A (/sites/site-a@user-siteb, expected:/sites/site-b@user-siteb) -
$siteNodeName: Name of the site node for site A (site-a, expected:site-b).
Did anybody else get the same behaviours or can tell me how to fix this?
Update:
The described behaviour does also occur when not using the package flownative/neos-multisitekickstarter.
I don’t remember the exact errors I was getting when I was trying to get this to work, but I’ll share a few points that gave me trouble.
Personally I went through Aske’s tutorial step my step (yes, I tried to just copy-paste at first, but obviously failed :P).
Getting the tutorial to work with 3.3 is the first step, some namespaces need adjustment (I think this is the only issue). After that, I had to adjust the privileges to match my project setup.
In my case, I had a project structure with one main site in Neos and I wanted to add other sites dynamically in subdomains, under a specific site package. For this, I had to add an extra rule that didn’t block read access to the main site, because being under the same domain triggered some calls to the main site (I think). If the domain of your siteA and siteB are completely different, you probably don’t have this problem.
For the multisite kickstarter I didn’t use it in the end, but it was a nice reference to see how they handled their policy. And from what I noticed, what the multisite kickstarter does is to generate a Policy.yaml file and add it to a newly created site package for your site. In my case I didn’t want that, I used the same site package for all subdomain sites and another site package for the main site, so using multisite kickstarter for my use case was not going to work I think.
Hey @dimitriadisg,
thanks for your feedback. I use two different domains, so two site packages that share some parts with each other but each one is for itself.
I also didn’t use the kickstarter to create the policy files and instead simply c&p them to my sites packages (with some adjustments in namings etc.). I only used flownative/neos-multisitehelper for the authentication provider.
The strange thing is, that i can log in to Site A without any issues (with a user that only has access to Site A) but the same does not work for Site B. Some variables do have the wrong values assigned (from my point of view), but maybe i’m wrong here.
Would be great if maybe @aertmann or @bwaidelich can help some more here.
Well, do both sites have domains assigned? Are both sites and their packages active? Because obviously the site cannot be found, for some reason?