Hi everyone. I work at a university where we are retiring our outdated CMS and implementing Drupal. I have some questions about role access hierarchy and document storage for such a large site and am looking for opinions and advice. I am relatively new to Drupal (about six months) so if I'm way off the mark on anything here please correct me.
In our current site we have over 280 root folders. These include academic programs, promotional websites, administrative units, etc.
I am currently using the Workbench Access module with the Taxonomy access scheme for defining the site hierarchy. In combination with the Pathauto and Token modules for developing SEO friendly URLs this is proving to work very well.
I had previously tried Organic Groups but found it a little less intuitive, and with the Workbench Access and Taxonomy scheme creating sub-folders within sites is much easier since you just need to add a term to a vocabulary and arrange the hierarchy and then workbench access, token and pathauto modules do the rest.
The Drupal method of providing role-based access is excellent. I have worked extensively with Banner (an educational institution ERP) which also provides role-based access so this is very familiar and intuitive to me.
However, the problem I am running into is the large number of roles that I think we are going to need, and how this large number of roles will be difficult to manage in the Drupal roles/permissions interface.
Consider the following sections of our website:
http://www.university.ca/anthropology
http://www.university.ca/biochemistry
http://www.university.ca/biology
http://www.university.ca/chemistry
http://www.university.ca/computerscience
http://www.university.ca/economics
http://www.university.ca/firstnationsstudies
http://www.university.ca/genderstudies
http://www.university.ca/geography
http://www.university.ca/history
These are all independent academic units and each will require its own set of editors, publishers and an owner. I use owner instead of administrator as I don't want to confuse an individual site administrator role with the Drupal administrator role.
I see no way of being able to make this work just using one common role for each of editor, publisher, and owner since if I want to control access to individual sections of the site, I will need to have individual roles for each.
*** IF SOMEONE SEES SOME FUNDAMENTAL DRUPAL CONCEPT OR IDEA THAT I AM MISSING THAT WOULD ALLOW THIS PLEASE LET ME KNOW!!! ***
The problem as you can see is that with just these ten sites above we will now have 30 new roles. This will quickly become unmanageable in the current Drupal roles/permissions management UI.
I had also planned on using the IMCE module to facilitate image and document management, especially since it allows for the definition of specific upload folders for each role type.
However, as already stated, this scenario will lead to well over a hundres roles to manage, and both the role/permissions and IMCE interfaces will not easily handle this.
From all of this I guess my question boils down to this:
To set up a site with hundreds of root folders and grant role-based access to each along with segregated file upload areas for each, is Workbench Acces and IMCE the right combination of modules to use or is there a better alternative that would achieve the same result?
Thanks very much in advance for any and all replies.
Pablo
Comments
I am in a similar situation,
I am in a similar situation, also looking for a solution.
would content access help?
i was immediately thinking about this module: http://drupal.org/project/content_access
or, alternatively, consider this (it's how i'm managing this same exact situation right now, so take it for what it's worth)
in drupal's interface, when you create new roles they are sorted automatically left to right, starting with anonymous and authenticated user.
what i did was create a bunch of roles (each with unique rights to do whatever) and then, in the admin interface for 'roles' i resorted them in order of priority (meaning the ones closest to the left (or top of the list) have "lowest rights"
why? when you click "authenticated user" under any permission, it automatically checks every box to the right of that role (in this case, all of them)
so, if you have 30 roles, but 20 of them can edit/view/etc, you can use 'content access' to manage that in one clean screen and basic roles/permissions interface to simply sort out the user types (the many roles in order of priority and rights)
the site i'm developing has very restrictive access rights, so what i did is as follows (after the above steps)
"authenticated user" can actually do nothing but register, and in my case, registration is invite only (using invite)
a few roles are able to invite users AND they also have a module called "role delegation" which allows them to change the roles of the people they invited - this way, i've pushed the responsibility for policing activity and access to the people who care about it the MOST
in your scenario, there may simple be a way to let "any member of a dept" change the roles of anybody they invite (and in turn, ask them to invite all of their own team members, so start with User A in that department, have that person invite all users B through K and then they can track invites, change roles, etc
this is just one approach, and it will work particularly well for my environment but i see no reason why it can't be repurposed for your use case.