Assign a role based on IP address

Here's a solution for a variation of this request. (This was done for Drupal 4.7.6.)

We wanted users in our local network to be able to come to our Drupal site and be treated as Anonymous logins, with the option to log in to do editing. We wanted users coming in from the internet to register and log in before they could see any content. It was not so obvious how to do this.

First, I renamed page.tpl.php (in my custom theme) and created a new one, like this:

<?php
/* If coming from the outside world, and anonymous, allow only login, user registration, and new password. 
 * (The left sidebar must contain a Login block, and the other blocks in 
 * that sidebar must be disabled by a PHP test of pih_authorized() )
 */
if (!pih_authorized()) {
    if (arg(0) == "user") {
	 /* Allow user registration and "new password" */
	 $sidebar_left = " "; /* non-empty for layout purposes */
    } else {
        $title = '<h2 class="title">Welcome</h2>';
        $content = "<p>You must log in when accessing this site from outside the firewall.</p>";
    }
    $sidebar_right = '<h2>Other Sites</h2><ul><li><a href="http://www.xyz.org/">xyz.org</a><li><a href="http://foo.xyz.org/">foo.xyz.org</a></ul>';
    unset($secondary_links);
    unset($primary_links);
    $header = "";
}

include 'page-default.tpl.php';
?>

Then I added the following to includes/common.inc:

/* Return True if user is authenticated OR coming from inside the intranet */
function pih_authorized() {
  global $user;
  return($user->uid > 0 || pih_internal());
}

/* Return True if user is coming from inside the intranet */
function pih_internal() {
  if (substr($_SERVER['REMOTE_ADDR'], 0, 11) != "123.123.123") return true;
  return false;
}

Which you can customize to select which IP addresses you want to allow.

And finally, I used the pih_authorized() function to hide blocks in the left sidebar, except for the Login block.

This seems to work, and aside from the code added to common.inc, it should survive a software upgrade. I suppose there is a better place to put that code other than common.inc.

-md

We're also looking for (and are willing to write / help write) a module that allows anonymous users from a range of IP addresses access to view pages, but requires anonymous users from all other IP addresses to log in first. I'd love to know if anyone else is interested / has been working on this sort of thing.

The troll module looks like it might contain relevant bits, but I haven't looked in detail yet.

it seems that module assigns users to IPs, not roles to IPs