I would like to be able to "stack" access roles in TA, so that as users are added to new roles, they gain new access permissions. With TA's method of applying deny after allow, this is not possible. I need to flip this around so that the allow permissions come last. More details are in this thread. I realize that another solution would be to remove users from previous roles when they are added to more permissive ones, but this would be a big pain since users can gain/remove access in various ways.

I'm willing to offer a bounty for this feature becoming available in the next two weeks. Thanks!

Comments

keve’s picture

keve commented

I thought before about making TAC to be able to change the order of allow, deny.
But until now, i did not got any request for this feature, so i postponed it.

I will look at the code more, i will check, but i had a concept before how to do it. I have to find it in my memories. ;)

stephthegeek’s picture

stephthegeek commented

Please please please and thank you :) Let me know what I can do in order to make this happen.

keve’s picture

keve commented

As I read your forum topic, there is maybe a misunderstanding. Or maybe i do not understand it exactly.
Maybe help page is not clear.

The "Order Allow,Deny" is applied to set permissions ONLY regarding ONE given user role (in case of nodes with multipleterms only).
E.g on category permission page for anonymous user you set ALLOW for term 'FOO1' and DENY for term 'FOO2', then in case of a node which has multiple terms 'FOO1' and 'FOO2' then the access is DENIED for anonymous users. It has nothing to do with other user roles. (like role1, role2).

When permission are set, TAC saves it to table node_access for each node and for each user role.
Then when user tries to access page, Drupal core checks this table for permission.
If user is member of eg. Role1 and Role2, then permissions for given node are 'OR'-ed together. That is if any user role (either Role1 or role2) for given user has view permission granted for the node, then Permission is ALLOWED.

Please, check with your installation, this should work this way. I also use hierarchically the user roles, that is authenticated users have some permission, then for user role Role1 has some added permissions (I do not re-apply those permissions that authenticated users already have).

I await your comments. Regards, Keve.

stephthegeek’s picture

stephthegeek commented

Funny you should mention this right now... I received the new book on Drupal last night and spent some time reading. It turns out that I had misunderstood the function of IGNORE. I thought there was no way to stack an ALLOW and effective DENY together. But after reading the book (which explains TAC better/in more detail than all the documentation I've read on drupal.org, IMO), I realized that IGNORE is effectively DENY!

This way I can have a role1, role2, and role3 with various IGNORE and ALLOW permissions for terms, and it doesn't matter whether a user is a member of any or all roles, they will always get the ALLOW permissions of the most permissive role. So it seems as though my problem didn't exist in the first place :)

My apologies for the panic! I do feel that TAC is a wonderful and exceptionally powerful module, but not the most user friendly off the bat. I am new to Drupal but I would be happy to help by writing up some additional documentation on exactly how I am accomplishing the access control I want using TAC.

keve’s picture

keve commented

No problem.

What is that book that you mention?

Writing better help page for TAC is also welcome.
Regarding the complicity of the access system, It would be perfect to illustrate it with some application schemas.

stephthegeek’s picture

stephthegeek commented

New book on Drupal

keve’s picture

keve commented
Status: Active » Closed (fixed)