The 2026 Drupal Business Survey is open. Your response will help shape the future of the Drupal business ecosystem.
By saltspringer on
Forgive me if this has been covered before, but I couldn't find a solution to my specific problem in the forums.
How do set up roles/category permissions if I want to have the following:
Groups A, B, C, each able to create pages and forum posts that are visible to only their own group, OR by choosing the appropriate categories, visible to other groups as well.
AND,
Have some users who are MEMBERS OF MORE THAN ONE GROUP, and able to see pages and posts that have been categorized for only one of the groups that they are a member of.
With Taxonomy Access Control, the problem seems to be that DENY is processed after ALLOW. From the Help page on this:
The DENY directives are processed after the ALLOW directives. (DENY overrides ALLOW.) So, if a multicategory node is in Categories "A" and "B" and a user has ALLOW permissions for VIEW in Category "A" and DENY permissions for VIEW in Category "B", then the user will NOT be permitted to VIEW the node. (DENY overrides ALLOW.)
I wish it was the opposite. As it is, a user with two roles is denied access to a document if one of his two roles is denied access to it.
Am I missing something?
Should I be using Organic Groups instead of Taxonomy Access? It seems like overkill for what I need, but maybe I should wade into it.
Comments
That excerpt is about a
That excerpt is about a role's access to a node through multiple categories. (a)
In the case of a user's access to a node through multiple roles, I have verified that if a user has one role which allows access and several other roles which deny access, then access is granted. (b)
- A "Deny" for a category applies to a role, not to a user. So, (a) decides the permissions for a role.
- Then (b) decides a user's permissions through all the roles of that user.
What I think this means in practice is that if you grant specific permissions using lightweight single-purpose roles (and not roles like full user profiles), then it is easier to avoid denied access to these roles because of multiple categories and also you will be able to withdraw access easier. On the other hand, you can use heavier roles (such as "registered user") for denying access to all "special" content (because a single additional lightweight role can change that).
For example, if you make someone a "registered user" *and* a "subscriber for editorials", the second role wouldn't need to have any other category permissions except what is required for reading editorials. You would not complicate the second role much because you might fall victim to (a).
Do I understand category permissions correctly?
Thanks CogRusty, but I'm still having trouble with this.
At least on my site, users with multiple roles do not get access if the category permission for one of their roles is set to DENY.
Am I setting category permissions correctly? I'm assuming that for Group (role) A, their category permissions for content tagged as Group (role) B should be set to 'DENY' for 'View', 'Update', and 'Delete'.
Maybe I should set up roles differently? Using the example described above, I could add new roles for people that are members of more than one group, for example, so that I would have Group (role) AB, Group BC, and so forth, but this would make management much more complicated, especially if the number of was greater than four or five.
I realize this is probably a bit of newb question, but any help appreciated.
At least on my site, users
You must have at least one role which actually grants access to the user. Verify it by removing from the user all the other roles except this one. Does the user has access with only this one role?
Then add the other roles and see if the user loses access. Normally it shouldn't happen.
Got it now; thanks
I had the category permissions set wrong - fixed it and then checked it with the different roles and now all is well. Thanks.