THIS ARTICLE APPLIES TO DNN VERSIONS PRIOR TO 5.0
The DotNetNuke framework is great in many ways but its website administration rights are not very granular.  In many cases you either need to have full admin rights or you simply won't be allowed to perform a critical function (like create new web pages).  Well, there is a trick you can do to extend certain ADMIN rights to selected users without actually making them administrators.  Best of all, you can do it from within the DNN UI...


THE ISSUE:  ADMIN tabs only available to ADMINISTRATORS
Let's say you've got a group of "content management" users who need to be able to create and edit web pages.  In short, they need complete access to the PAGES admin tab interface.  Unfortunately, PAGES can only be accessed by users who are ADMINISTRATORS and is therefore not available to non-admins.  Or is it?

There is a simple method you can use to make ADMIN tabs available to any user role.


Two Methods:  PARENT PAGE and PARENTID
The secret is to use the "PARENT PAGE" setting of the PAGES page to move PAGES out of the ADMIN tab area.  Unfortunately, the pages under the ADMIN tab do not allow you to access the PAGE SETTINGS.  Fortunately there are two ways we can set the "PARENT PAGE" value:

Method 1:  Use the DNN UI (PARENT PAGE)
If you do not have database access (or are simply not comfortable mucking around with SQL) you can move the PAGES page using your site's web pages.  Here's how:

1. Log in to your portal as an administrator.
    
2. Browse to ADMIN->PAGES.  Look at the URL and make a note of the tabid value (the number in the URL following "/tabid/").
    
3. Copy-and-paste the following URL into your browser, substituting your own domain and tabid values:
    
   http://{your domain}/tabid/{your tabid}/ctl/Tab/action/edit/Default.aspx
    
4. Now you should be on your PAGES' page SETTINGS.  Change the "PARENT PAGE" value from "ADMIN" to something outside of "ADMIN" (or to "None Selected").
    
   That's it!  Now you can use the PERMISSIONS settings to decide which users can see/edit the PAGES page.

Method 2:  Use SQL (PARENTID)
If you do have database access and are comfortable with SQL UPDATEs you can accomplish the same thing as Method 1 directly from the DB.  Simply UPDATE the TABS table with "PARENTID = NULL" where "TABID = {your PAGES tabid}".   Done.  Be sure to go back to the PAGES's SETTINGS to set up your user permissions.


OTHER ADMIN PAGES
This same trick can be used on other ADMIN tabs (we often do this with both the PAGES tab in addition to the FILE MANAGER* tab).  Just remember to be extra careful about what tabs you move and what permissions you set.  The IT security rule-of-thumb is "Always give only the minimal level of access needed to accomplish a goal".
 

*** A special note about FILE MANAGER:
The FILE MANAGER requires a few extra steps to be functional for non-admins.  The FILE MANAGER module utilizes a special "UPLOADROLES" module setting that determines who can upload files.  In addition to the steps above, you'll need to add a database entry (via SQL) for each user security role that you wish to grant uplaod rights to.  I recommend creating a new security role called "FileAdmin" so you can easily administer file management rights separate from other security roles.

Instructions for granting file management rights:
You MUST use SQL for this (if you do not have a SQL management tool/editor and have a HOST account for your DNN site you can execute SQL using the basic interface under HOST->SQL).

1. Go to ADMIN->SECURITY ROLES and create a new security role named "FileAdmin". 
    
2. Using SQL, run the following query to determine the role ID value of your new "FileAdmin" role:
    
   Select ROLEID, PORTALID from ROLES where ROLENAME = 'FileAdmin'
    
   Note that, if you have more than one portal, you will have more than one value returned if you've created this role on multiple portals.  Used the PORTALID value to determine which ROLEID value to use.  If this is the first time you've done this you should only have one ROLEID value returned. 
    
3. Now we need to know the module Id of the File Manager module.  Using SQL, run the following query:
    
   Select MODULEID, PORTALID from MODULES 
   where ModuleTitle = 'File Manager'
    
   Again, as in step 2, if you have multiple portals then use the PORTALID value to determine which MODULEID is the correct one for the portal you're working with. 
    
4. Using SQL, run the following INSERT to add the "FileAdmin" role to the list of roles allowed to upload files using the FILE MANAGER module:
    
   INSERT INTO MODULESETTINGS ( ModuleID, SettingName, SettingValue )
   VALUES ( {your moduleid}, 'uploadroles', {your roleid} )
    
5. Now we need to grant edit rights to the FILE ADMIN module.  To get to the module's SETTINGS page we'll use the same trick we used to get to the FILE MANAGERS page settings.  In your browser, enter the following URL:
    
   http://{your domain}/tabid/{your tabid}/ctl/Module/ModuleId/{your moduleid}/Default.aspx
    
   Under PERMISSIONS grant "EDIT" rights to the new "FileAdmin" role. 
    
6. Finally, on the FILE MANAGER page under FOLDER SECURITY SETTINGS, give both "View Folder" and "Write to Folder" rights to the "FileAdmin" security role for the ROOT folder. 
    
7. (THIS STEP IS OPTIONAL) One quirk with this is that those who get "EDIT" rights to the FILE ADMIN module will also end up getting a partial CONTROL PANEL display (the admin/page editor bar across the top of the page, above the skin).  This is unnecessary and potentially confusing.  It doesn't hurt anything, but if you'd prefer it to not appear you can add the following line to the very bottom of your DNN skin file (sorry - this won't work from inside a Text/HTML module or from within a page's Header Tags setting):
    
   < % If Not DotNetNuke.Security.PortalSecurity.IsInRoles(PortalSettings.AdministratorRoleName) % >
      < style >.ControlPanel{display:none}< /style >
   < %  End If  % >
    
   Please note that this will hide any HTML element using the CSS class "ControlPanel".  To limit this change to your File Manager page:  Create a copy of your skin's .ASCX file, apply this change to the copy and set your File Manager page settings to use the copy instead of the default skin.
    

Whew!  Ok, so that's a lot tougher than it was to get the FILE MANAGER page out of the ADMIN area.  Fortunately you found our blog and (hopefully) our notes have saved you some time and headache.  At the very least, if you decide this looks a bit too complicated then you can feel better about shelling out some cash for a third party file management module.

UPDATE (11-24-2008):
This blog entry was referenced in a thread over in the DotNetNuke.com forums.  One of the ensuing comments came from the well-known Mitchel Sellers, a longtime DNN developer and contributor up in Iowa and a current member of the DNN "Documents" core module development team.  Mitchel pointed out that the ADMIN modules were never intended to be shared among non-admin users and that there could be security risks involed in doing so.

Quite right!  Although the underlying functionality is already built into DNN for sharing ADMIN modules as well as for moving them around to various pages on a portal (same as "normal" modules), the ADMIN modules themselves have probably not been inherently subjected to the same level of vulnerability testing as non-admin modules which get a much greater pounding via use by the general (non-admin) DNN population.

Keeping that in mind, admins would be well-served to follow the rule-of-thumb advice I cited before: "Always give only the minimal level of access needed to accomplish a goal".

Thanks for reading, Mr. Sellers!