Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.In Alpha2, if you log in as a user with a domain access role assigned, the permissions work on the very first request after clearing the cache, but on subsequent requests the permissions are gone.
Tagging an Alpha2 with the fix.
Note that there's a core TODO in the code copied into the overridden method- #2345611: Load user entity in Cookie AuthenticationProvider instead of using manual queries . This may need to get revisited if that issue is fixed.
Also the domain negotiator service has not loaded a domain at this stage in the processing, so we trigger a refresh of this.
Comments
Comment #2
freelockThis is broken because the user entity is not loaded from the session.
Instead, a lightweight session user is loaded directly from a query on the database.
To fix this, I created a new Authentication Provider with a higher priority than the default Cookie provider. This "DomainCookie" provider extends the Cookie provider, and rewrites the roles loaded from the database for the visited domain, before instantiating the UserSession object.