Configuring Access

Administrators perform these tasks.

Configuring access control requires selecting which content types are under access control and what action to take when an unauthorized visitor requests one of those content types. For an overview of Brightspot’s access request flow, see the diagram Access request flow.


Access control does not apply when you are logged in to Brightspot. For example, if your publication requires a subscription to watch videos, when you are logged in to Brightspot you can watch the videos without a subscription.

Configuring Content Substitutions

You can configure the content Brightspot substitutes when it receives a request for controlled content to which the requester does not have access.

If your Brightspot deployment is missing any of the following configuration options, contact your Brightspot developer.

  1. From the Navigation Menu, select Admin > Sites & Settings.

  2. Select a site for which you want to configure substitutions. Select the Global site if you want all sites to inherit the configuration settings. For more information, see Understanding Site Hierarchy.

  3. Under the Front-End tab, under Access, do the following:

    1. From the Access Substitution list, and using the following table, select the action Brightspot takes when receiving an unauthorized request for controlled content.

    2. From the Content field, enter or select the content to display. Your form looks similar to the following:

  4. Click Save.

The following table describes the types of access substitution.

Access Substitution Content
None N/A. Brightspot returns an HTTP status code 403 (Forbidden). Developers can provide a graceful recovery to the visitor by configuring the Tomcat server’s configuration file web.xml.
Content Substitution Displays the selected item—even if the selected item itself is under access control. For example, an unauthorized visitor requests an article, and articles are under access control. If you have an item called Pay Wall that is also an article, Brightspot displays the pay wall.
External Redirect Redirects the visitor’s browser to the indicated URL.
Internal Redirect Displays the selected item unless the selected item is under access control and the visitor is not authorized to see it. For example, an unauthorized visitor requests an article, and articles are under access control. If you have an item called Pay Wall that is also an article, Brightspot does not display the pay wall. When using this substitution, be sure you select a content type that is different from the one under access control.

Applying Access Control

The following procedure applies access control to content types you select.


After performing this procedure Brightspot immediately applies access control, and visitors to your site may see unexpected results such as “Forbidden” errors. Configure the content substitutions as described in Configuring Content Substitutions before proceeding with this procedure.

  1. Open the content edit page for the required access control.

  2. From the Content Types list, select the content types to which you want to apply access control.

    • Depending on your version of Brightspot, your content edit form may look different.
    • If you don’t see the content type to which you want to apply access control, contact your Brightspot developer.
  3. Click Publish.

See also: