I've been testing Domain access for a while now. I already have a functional installation with one Drupal, two sites, Domain access installed to sites/all and a shared database with no prefixes. The sites exist on the same domain, different subdomains. Content creation, switching between the sites etc works fine. This is a clean install with just the Shared signon module installed in addition. In use are PHP 4.3.9 and MySQL 4.1.20. All Domain access modules are enabled.

At this point my goal would be to have two kinds of pages, and the option to choose either of these when creating a page:
- Pages assigned to the first site ("hub"), which are visible on the "child" site(s)
- Pages assigned and visible only on a specific "child" site. There will be more of these sites, at which point this structure will make much more sense.

The options of Domain access that I have in use:
- sub1.domain.com as the main domain and sub2.domain.com as the other domain
- New content settings: Only show on selected sites
- Domain node types: Everything unchecked
I've also been switching the related options in the node itself back and forth.

The problem is, that no matter what I do to any of these options, all nodes are visible on both of my sites, both to anonymous users and logged in users.

Just in case, please also have a look at this bug report which I made earlier, in case it could possibly have something to do with the situation: http://drupal.org/node/284238

I really don't know if there's something simple that I just don't get or is there a larger problem - help greatly appreciated in any case.

Comments

agentrickard’s picture

agentrickard
he/him
Primary language English
Location Georgia (US)
commented

What do the debugging reports tell you about the access rules on specific nodes?

mnordstrom’s picture

mnordstrom commented

node/1:

Subdomains: sub2
Source domain: sub2

node/2 and node/3:

Subdomains: sub1
Source domain: sub1

So, nothing new here. All of these nodes are visible on both subdomains, as previously mentioned.

agentrickard’s picture

agentrickard
he/him
Primary language English
Location Georgia (US)
commented

And these are not assigned to "all affiliates" and the users in question:

a) Do not have the "administer nodes" permission
b) Are not user 1
c) Did not create the nodes in question

If any of the above are true, the node will be visible.

There is probably a setting wrong somewhere, otherwise, the module never would have made it out of testing.

mnordstrom’s picture

mnordstrom commented

Thanks for your answer. I've checked everything countless times, and everything is exactly like it should be. These nodes are all created by the admin user (id 1), and I have another user with id 3. All the nodes are visible to both of these users, no matter which site I'm on. The only permission authenticated users have is "access content". Without it they naturally don't get access to any nodes. I'm accessing the nodes through url's like subX.domain.com/?q=node/X, and there's no difference between the output of separate subdomains except for the changing site itself.

All the settings for Domain access are in the same state as I told in my first post. If there's nothing else that's not mentioned here that could affect this behavior, I can't think of anything but these lousy old PHP and MySQL versions which are causing the problem.

Still having something up your sleeve?

wayland76’s picture

wayland76 commented

@agentrickard: since his situation seems somewhat similar to mine, would the code at http://drupal.org/node/216148 help him by any chance?

@convulsion: My 5.x site has the code in that other issue inserted into it. Not sure whether it works with 6.x or not.

agentrickard’s picture

agentrickard
he/him
Primary language English
Location Georgia (US)
commented

@convulsion

I wonder if there is something else going on related to the PHP version. Try putting this code into a block and reporting what it outputs on each domain:

global $_domain;
print_r($_domain);

You will need to set the block to use the PHP input filter. This will print out the derived domain values that your site is using.

agentrickard’s picture

agentrickard
he/him
Primary language English
Location Georgia (US)
commented

@wayland76

I re-read your original issue, and, like this one, the solution does not explain the cause of the problem.

Both of you are experiencing behavior that other (including me) are not, and we need to figure out why.

mnordstrom’s picture

mnordstrom commented

@wayland76:
Hmm, gave authenticated users the administer nodes permission, tried that patch out, and couldn't find any difference in anything. Did it work for you by just adding it into domain.module? However, I noticed that my test user has the correct permissions for editing without any patch if administer nodes is switched on!

The test user is assigned for sub2 in his Domain access settings. I also noted that this user can log in on both subdomains, guess it shouldn't work like that? Anyway, the nodes assigned for sub2 are editable by him on both subdomains (the edit link points to sub2 from sub1), while the ones assigned for sub1 are not. Just wish I could extend this functionality to visibility. :)

@agentrickard:
Edited the paths since I don't want any traffic to my to-be-done site yet (they were completely correct). Here are the outputs:

Array (
[domain_id] => 0
[sitename] => Hub site
[subdomain] => sub1.domain.com
[scheme] => http
[valid] => 1
[path] => http://sub1.domain.com/
[site_grant] => 1 )

Array (
[domain_id] => 1
[subdomain] => sub2.domain.com
[sitename] => Child site
[scheme] => http
[valid] => 1
[path] => http://sub2.domain.com/
[site_grant] => 1 )

agentrickard’s picture

agentrickard
he/him
Primary language English
Location Georgia (US)
commented

I think this is user error, then.

If a user can 'administer nodes' then node access rules DO NOT APPLY and I cannot help you.

If you are sharing domain cookies or using single-signon, then yes, a user can login to both sites, by design.

mnordstrom’s picture

mnordstrom commented

But what about the anonymous users who can access the content from both sites? There will be also a user role without editing permissions, so the same applies to that group. These are my main problems, the sign-on thing isn't one.

Just brought that editing thing up since there will be also editors, and I figured that could give you some hint about what's going on in general, something works and something doesn't.

agentrickard’s picture

agentrickard
he/him
Primary language English
Location Georgia (US)
commented

Without seeing the site, I cannot help. I think you are simply misunderstanding some fundamental concepts.

By design, anonymous users can see content for:

a) Content sent to 'all affiliates'
b) Content assigned to the domain they are currently viewing.

The only way to change behavior b) is by using Domain Strict.

The only other option for debugging is to use Devel to see what queries are actually being run on your pages. Look for 'pager_query' output.

It is possible that 'all affiliates' grants have been set. In which case you should look in the {node_access} table for the realm 'domain+site'.

mnordstrom’s picture

mnordstrom commented

Well, I can assure you that neither a or b is the case here. I'm starting to get desperate, one thing I haven't mentioned is that the three listing pages under Affiliated content are showing the correct content. Nothing in 'Content for all affiliate sites', since I've assigned everything to either subdomain, and exactly the correct content for the separate subdomains below. Still:
- All stories with 'promote to front page' are visible on both default front pages (/node).
- All content is visible by direct node urls through both subdomains.
- The previous is true for all users, anonymous or not, with the only permission being 'view content'.
- No settings of Domain access that I have in use should allow this behavior.

I found this line in the README of Domain Strict:
Anonymous users will only be able to view content that is assigned to "all affiliates."
I've had Domain Strict enabled almost all the time and absolutely no content assigned to all affiliates - still everything is visible everywhere. :( I think this proves that the problem isn't my lack of understanding.

Can't think of much else anymore than the old PHP and MySQL versions, we're finally getting them updated next week and I _really_ hope it would solve the problem, we'll see. Devel requires PHP 5.2 too and gives me errors, sigh. I was able to get some queries, don't know if they all were there but at least searching the pages for pager_query gave me no results when viewing nodes. Thought I'd still paste the content of my node_access table in case you get something out of this:
nid gid realm grant_view grant_update grant_delete
0 0 all 1 0 0
0 0 domain_all 1 0 0
2 1 domain_id 1 0 0
3 0 domain_id 1 0 0
1 0 domain_id 1 0 0
4 0 domain_id 1 0 0
5 1 domain_id 1 0 0

Anyway, really appreciate your help, please let me know if you still come to think of something I could try, otherwise I'll let you know later what happened with the version update.

agentrickard’s picture

agentrickard
he/him
Primary language English
Location Georgia (US)
commented

That first entry in {node_access} should no longer be there. It is causing the problem.

nid gid realm grant_view grant_update grant_delete
0 0 all 1 0 0

This grants view access to all users at all times.

Remove it manually. (Which is odd, since rebuilding access permissions should do that for you.)

mnordstrom’s picture

mnordstrom commented

This worked! Thank you sooo much. :)

If you're going to investigate this further in order to make some patch, feel free to ask anything you need to know about the causes of the problem.

agentrickard’s picture

agentrickard
he/him
Primary language English
Location Georgia (US)
commented
Status: Active » Closed (fixed)

Well, normally this should reset itself when you rebuild node permissions at Admin > Content > Post Settings or when you enable the module. Chalking this up to a fluke.

mnordstrom’s picture

mnordstrom commented

Just wanted to let you know, tried that rebuilding at this point. The result was that the permission restrictions were gone again, that problematic line in {node_access} made a comeback. :O Removed it manually again.

Yura’s picture

Yura commented

I have same issue. If you let me understand which file is containing that entry (mentioned on #13) for manual deleting I will be appreciate.

Yura’s picture

Yura commented
Status: Closed (fixed) » Postponed (maintainer needs more info)

Each front page pointing same node If you let me understand which file is containing that entry (mentioned on #13) for manual deleting I will be appreciate.

agentrickard’s picture

agentrickard
he/him
Primary language English
Location Georgia (US)
commented

It is not a file. It is the default row in the {node_access} database table.

agentrickard’s picture

agentrickard
he/him
Primary language English
Location Georgia (US)
commented
Status: Postponed (maintainer needs more info) » Closed (fixed)