Is it possible to password protect a node without having to build taxonomies and/or configure special roles? I have many clients and want each of them to have a private, password protected page where I can provide downloads, links, invoices, etc. I also have many teams that have the same need.

I tried using the node_access_byrole module, but after a few users the table size became unusable with my browser, also I really need to limit access by user or node, not role. Now I am tinkering with taxonomy_access module but it seems to be even more convoluted than access by role.

I am looking for a way to simply create a page and check a box that says "password protect" and enter in a password. That way any one I give the password and uri to can go view the page.

* side note ( I have spent weeks reading these forums, and I try to do a lot of research before I ask a question, and I spend a lot of time on their wording. But my last several posts have gone completely unanswered and I am beginning to feel unloved :( If anyone reading this knows anything, even if it's "hey man, no one else cares about that functionality so you might as well drop it " I would greatly appreciate it.")

Thanks

Comments

Aran Deltac’s picture

We here at drupal do not tolerate begging.

Heh, just joking. I was going to respond to your post anyways even without your plea for help.

To my knowledge - no, there is currently no way to do exactly what you are asking for. Also, to my knowledge, I don't know how possible it would be to write said functionality. There may be a module developer out there that could do the trick, but you'd have to pay for it.

Last of all, why not use the Taxonomy Access module???

--
http://www.electroniclife.org/

ec’s picture

Try organic group here http://drupal.org/project/og this gives you the ability to create as many groups as you want and fill each of them with as many users as you want and then decide either their contents are private or not. Regards.

zach harkey’s picture

Organic groups looks promising, I am wrestling with it right now. I accidentally unchecked the initialization box (because it said "only do this step once" and I didn't want the step to be repeated when I resubmitted the form. But I ended up deactivating the module altogether) so of course I had to re-activate the module which required me to re-initialize it and now I have a broken module. I have tried to remove the tables, deactivate the module, and start over from scratch, but that is only making things worse. Arrgh... and it looked so promising.

: z

Aran Deltac’s picture

Always test modules on a test site. Then you can blow it away and re-install if you make a booboo.

zach harkey’s picture

This is my test site, so no harm done. But I would like to keep from having to roll back my whole database. Is this unfixable? Did this module just hose my whole site? To keep topics separated (since I am still looking for the answer to my original question), I have started a new thread regarding my problems with organic groups.

: z

sepeck’s picture

See test site section http://drupal.org/node/17557
I have a friend that is using the Organic Groups module for his site in the manner you are describing and he is quite happy with it.

-sp
---------
Test site...always start with a test site.

-Steven Peck
---------
Test site, always start with a test site.
Drupal Best Practices Guide

RobRoy’s picture

I'm interested in password protect a node for anonymous users. We post nodes and specify a password and then give it out to those who are allowed to see our node. Upon first visit to the node, we require the password to view it, then should store this in the anon user's session. Is there much integration with any Drupal hooks for this? I'm looking into node_grants, but everything seems to be tied to a UID.

Any ideas would be appreciated.

--
Rob
Founder and Director
Electronic Insight Corporation

Recent Drupal Projects: MP3PIG | MySpace Layouts

designanddraft’s picture

i am looking for something like this but specifically for all admin pages in order to edit.
i want to give all registered users the ability to see and use the admin part of the site, but password protect or lock certain pages, prevent editing by all but admin. thanks i will probably start a new topic as this is quite old. v 6.x

the_therapist’s picture

I just needed a basic road block to stop people from viewing a single Drupal node (page). I added the following PHP code in the content body (make sure the input format is PHP code and change the username/password to anything you want):

// Authorization
	$username = $_SERVER['PHP_AUTH_USER'];
	$password = $_SERVER['PHP_AUTH_PW'];
	if (!isset($_SERVER['PHP_AUTH_USER'])
	|| $username != "qwerty" || $password != "qwerty") {
		header('WWW-Authenticate: Basic realm="Please Login"');
		header('HTTP/1.0 401 Unauthorized');
		print 'Sorry, incorrect password or username.';
		exit;
	}
matthewcornell’s picture

Question: When does it re-ask for the login? The page asked for validation when I submitted it, but I couldn't find a pattern. I cleared browser cookies, but that didn't seem to matter.

Thanks,

matt

matthewcornell’s picture

I tried this, worked like a charm, but after a few days I realized I wasn't getting any notification emails about comments from my blog. I checked Notification settings and saw the warning (below). Just in case anyone else wants to try this solution: beware.

> Nodes or comments which include PHP code might in some circumstances break your web site. They might cause notify to run in a loop or completely malfunction. This is not a bug: if you are adding some PHP code into your content, you are supposed to know what you are doing. See the handbook page for notify.module. [http://drupal.org/handbook/modules/notify/]

the_therapist’s picture

Thanks for the follow-up. It was my super-quick fix, but is not really meant for serious access restriction. Any module listed in this thread would probably be better at that.

Once you have been authorized by Apache you have access to that "folder" until your session ends, i.e., you close your browser.

jenniferannwalsh’s picture

I put this in a customized page.tpl.php file (page-invite.tpl.php). The login box shows up fine but no matter what I type in the username and password fields, the login box just keeps showing up over and over. I don't get the error message until I hit 'cancel'. I thought maybe it had to do with being in the tpl file instead of the node so I created a new node and pasted this in (with PHP input format). I was not able to save the new page since the login box appeared when I hit save and wouldn't go away despite my using the correct password. Thoughts?

. . . . . . .
jen

jenniferannwalsh’s picture

The information on this page helped:
http://drupal.org/node/328222

To quote it:
If you are using HTTP authentication and are unable to log in, PHP could be running in CGI mode. When run in CGI mode, the normal HTTP authentication variables are not available to PHP. To work around this issue, add the following rewrite rule at the end of the .htaccess file in Drupal’s root installation directory:

RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization},L]

. . . . . . .
jen

mattyoung’s picture

http://drupal.org/project/protected_node

Enable the module, set Anonymous role to have access to protected node. Set password on the node you want to protect.

gnat’s picture

Another way to do this is to put an empty directory in your Drupal root. Lets say we call it "protected". In your new protected directory, create .htaccess that contains this:

AuthUserFile /path/to/passwd/file/.htpasswd
AuthType Basic
AuthName "Restricted area log in"
Require valid-user

Then using your standard htpasswd command (or however you tend to create them), create the password file and user(s)/ password(s).

Now go and create a node. If you give it a URL alias of "proctected/foo" or "protected/anything-else". Anything at that path will now be protected by htaccess/htpasswd.

Caveats: This will only work with clean URLs enabled. This whole setup is wildly prone to URL hacking; a user can use both the nod/nid path and the "?q=protected/" non-clean URL path. This is security through obscurity at best.

I've only tested this with D6, on Debian, running Apache2 - your mileage may vary on other setups.

kundu’s picture

It's 2018 and I love your solution. It works. Tested with Drupal 8.

Thanks

slosa’s picture

staceyrice’s picture

For anyone stumbling across this for Drupal 7, try https://drupal.org/project/protected_pages