When working with users and roles in Kentico CMS it is sometimes tricky to find the needed UI permissions. This post will cover a tip for debugging the permissions needed.
I usually run a test by impersonating the user and try to modify some documents and clickthrough the modules needed. Sometimes I get screens like the following:
Kentico informs me that the user needs a role that is allowed to "Read" the "Web Analytics" module. In this case it is pretty straight forward what permission needs to be given to the role. In other cases, like developing custom modules, it is easier to find it out using Security debug.
To enable Security debug, add the following AppSetting to your web.config:
<add key="CMSDebugSecurity" value="true"/>
This will enable the Security debug via Site Manager --> Administration --> System --> Debug --> Security. Here you will find the security log that displays the checks and the permission the user needs fo access the WebAnalytics module.
Hope this helps!
For more information on debugging please read the post on debugging options in Kentico CMS by Martin Hejtmanek.