<p>The back end of craft (admin log in section or Control Panel) can only be accessed by admins and users that an admin has added. The front end will always be visible to everyone while the backend will be password protected. </p>

<p>If you want separate front end displays for people who have usernames and passwords and those who dont, you could add a front end log in form:</p>

<p><a href="http://buildwithcraft.com/docs/templating/login-form" rel="nofollow">http://buildwithcraft.com/docs/templating/login-form</a></p>

<p>And display one set of templates for those who are logged in and another for those who arent logged in via conditional statements e.g. </p>

<p>{% if currentUser %} 
  Protected info 
{% else %} 
  public Info 
{% endif %} </p>

<p>If this isn't quite the answer you're looking for could you be slightly more specific with what you mean by "on the domain". Describe exactly what you're looking to achieve. </p>

CC BY-SA 3.0
2015-10-28T14:52:41.567Z
I updated it. By "on the domain" I mean the CP and certain functionalities on the website can only be accessed by those who have the admin password/login AND are accessing it directly from the work network.
Exziled
CC BY-SA 3.0
2015-10-28T15:27:35.040Z
Ok so you can definitely create password protection and allow for specific functionalities to those with logins. In the CP this can be further customised in the users permissions sections.
Customising functionality directly for your work network however may be problematic. You could try and add some configuration dependent on IP address, possibly in the config.php, but as far as I'm aware there isnt anything built into craft that would give this "out of the box".
George Dunning
CC BY-SA 3.0
2015-10-28T14:26:00.930Z
2015-10-28T14:26:00.930Z
George Dunning
<p>Assuming your network is behind a router that's setup for DHCP that's handing out a block of IP addresses (typically <code>192.168.xxx.xxx</code>), you could protect pages using <code>craft.request.getIpAddress()</code> and checking that it's within your allowed IP range.</p>

<p>Keep in mind that's not the most secure method in the world given that it's fairly trivial to spoof the IP address headers on a request.</p>

<p>Alternatively, if your network has a central login authority (like an Active Directory server), then you're looking at creating a Craft plugin that authenticates with something like LDAP to provide proper authentication/authorization for areas of your site.</p>

CC BY-SA 3.0
2015-10-28T15:39:27.160Z
That's exactly what it is. We use AD here so I'm looking to find a way to validate that they are on this domain and then allow them to log in. I'm very new to craft and all of this so I'm still trying to wrap my head around it and the best way to ask these sorts of questions!
Exziled
CC BY-SA 3.0
2015-10-28T16:55:11.700Z
Probably worth reading, then: http://craftcms.stackexchange.com/a/5071/57
Brad Bell
CC BY-SA 3.0
2015-10-29T04:08:22.967Z
I'm surprised Craft doesn't offer up a template variable with just ``$_SERVER['REMOTE_ADDR']``? Just looked at the code and it goes through some hoops to get the "right" IP but if you're on a trusted LAN, you don't need the checks...
RitterKnight
CC BY-SA 3.0
2015-10-29T04:10:21.670Z
@RitterKnight We've got it at the PHP level with `craft()->request->getUserHostAddress()`. No one has ever requested to have it exposed to Twig, though.
Brad Bell
CC BY-SA 3.0
2015-10-29T04:18:10.653Z
@Brad: Yeh, probably for good reason... (if you're going to limit via IP and are serious about security, you do it on the web server.)
RitterKnight
CC BY-SA 3.0
2015-10-28T15:36:14.367Z
2015-10-28T15:36:14.367Z
Brad Bell
<p>I'm assuming the web server is "local" and sits behind the firewall with the rest of the NAT'd work group? Depending on what pages you need to limit access, you could lock it down at the NAT/server level.  </p>

<p>If it were me, I'd do something like <code>companyintranet.whatever.com</code> and use Craft's routing to set up the company only pages (on say a separate structure section). That way, they don't get accidentally mingled in with the rest of the public facing pages. As long as all pages point back to a single CP instance, that's <a href="http://buildwithcraft.com/help/license-enforcement" rel="nofollow">covered</a> on Craft's license.</p>

CC BY-SA 3.0
2015-10-29T04:09:44.933Z
2015-10-29T04:09:44.933Z
RitterKnight
<p>How would you make portions of Craft available to only people that are "on the domain" and then let the rest of it be public facing? Would you need two instances of craft on 2 servers? One which is accessible only from "inside" and another that the public can access?</p>

<p>Would this entail running Craft on one webserver and the front-end on another? This way the webserver with craft on it is only accessed internally but the front-end can be accessed outside?</p>

<p>edit: I only want CP to be accessed by people who are logged in and on the work network. For security reasons a simple login is not enough.</p>

<config><security><aws>
Craft pieces accessed by people on domain only
# Craft pieces accessed by people on domain only

(Asked by: username_0 on 2015-10-28)

How would you make portions of Craft available to only people that are "on the domain" and then let the rest of it be public facing? Would you need two instances of craft on 2 servers? One which is accessible only from "inside" and another that the public can access?

Would this entail running Craft on one webserver and the front-end on another? This way the webserver with craft on it is only accessed internally but the front-end can be accessed outside?

edit: I only want CP to be accessed by people who are logged in and on the work network. For security reasons a simple login is not enough.

**Tags:** config, security, aws


---

## 3 answers

### Answer by username_1 on 2015-10-28. Score: 2

The back end of craft (admin log in section or Control Panel) can only be accessed by admins and users that an admin has added. The front end will always be visible to everyone while the backend will be password protected.

If you want separate front end displays for people who have usernames and passwords and those who dont, you could add a front end log in form:

<http://buildwithcraft.com/docs/templating/login-form>

And display one set of templates for those who are logged in and another for those who arent logged in via conditional statements e.g.

{% if currentUser %}
Protected info
{% else %}
public Info
{% endif %}

If this isn't quite the answer you're looking for could you be slightly more specific with what you mean by "on the domain". Describe exactly what you're looking to achieve.

> **Comments:**
> **username_0**: I updated it. By "on the domain" I mean the CP and certain functionalities on the website can only be accessed by those who have the admin password/login AND are accessing it directly from the work network.  
> **username_1**: Ok so you can definitely create password protection and allow for specific functionalities to those with logins. In the CP this can be further customised in the users permissions sections. Customising functionality directly for your work network however may be problematic. You could try and add some configuration dependent on IP address, possibly in the config.php, but as far as I'm aware there isnt anything built into craft that would give this "out of the box".  

---

### Answer by username_2 on 2015-10-28. Score: 0

Assuming your network is behind a router that's setup for DHCP that's handing out a block of IP addresses (typically `192.168.xxx.xxx`), you could protect pages using `craft.request.getIpAddress()` and checking that it's within your allowed IP range.

Keep in mind that's not the most secure method in the world given that it's fairly trivial to spoof the IP address headers on a request.

Alternatively, if your network has a central login authority (like an Active Directory server), then you're looking at creating a Craft plugin that authenticates with something like LDAP to provide proper authentication/authorization for areas of your site.

> **Comments:**
> **username_0**: That's exactly what it is. We use AD here so I'm looking to find a way to validate that they are on this domain and then allow them to log in. I'm very new to craft and all of this so I'm still trying to wrap my head around it and the best way to ask these sorts of questions!  
> **username_2**: Probably worth reading, then: http://craftcms.stackexchange.com/a/5071/57  
> **username_3**: I'm surprised Craft doesn't offer up a template variable with just ``$_SERVER['REMOTE_ADDR']``? Just looked at the code and it goes through some hoops to get the "right" IP but if you're on a trusted LAN, you don't need the checks...  
> **username_2**: @username_3 We've got it at the PHP level with `craft()->request->getUserHostAddress()`. No one has ever requested to have it exposed to Twig, though.  
> **username_3**: @Brad: Yeh, probably for good reason... (if you're going to limit via IP and are serious about security, you do it on the web server.)  

---

### Answer by username_3 on 2015-10-29. Score: 0

I'm assuming the web server is "local" and sits behind the firewall with the rest of the NAT'd work group? Depending on what pages you need to limit access, you could lock it down at the NAT/server level.

If it were me, I'd do something like `companyintranet.whatever.com` and use Craft's routing to set up the company only pages (on say a separate structure section). That way, they don't get accidentally mingled in with the rest of the public facing pages. As long as all pages point back to a single CP instance, that's [covered](http://buildwithcraft.com/help/license-enforcement) on Craft's license.


---

