I am using Taxonomy Access Control in other sites to create pages only accessible to certain roles. TAC does not seem to work with DA, is there another way to restrict access to specific nodes / views etc based on roles when using DA? Or does TAC work with DA and I have more setup to do. I have searched through the issues log, drupal forums and generally online but can't find an answer.

CommentFileSizeAuthor
#20 domain_tac.zip1.51 KBvlooivlerke

Comments

agentrickard’s picture

You need glue code to make the two modules work together, assuming that you want access rules to be "approved by TAC AND DA" instead of the core "approved by TAC OR DA".

There is a long issue in the queue that shows how to do this with OG (another access control module).

See the provided documentation on how Node Access works.

kurtfoster’s picture

I think this is the og issue agentrickard is referring to https://drupal.org/node/1355272, looking into it now.

agentrickard’s picture

Yes, it is that issue, thanks.

kurtfoster’s picture

Forgive my module building noobness here but I have taken the domain_og module and made a domain_tac module. I have only just finished it, on a brief test it appears to be working. I will do some more testing tomorrow but if you have any comments / issues let me know. It would be great to have this working, I am sure there are more folks out there wanting these two to play together.

domain_tac.info

name = Domain Access Taxonomy Access Control Bridge
description = Combines node access settings of the Domain Access and Taxonomy Access Control modules into a new access realm
core = 7.x
package = Domain Access
dependencies[] = domain
dependencies[] = taxonomy_access
version = "7.x-1.x-dev"
core = "7.x"

domain_tac.module

<?php
/**
 * Bridge module to allow Domain Access and Taxonomy Access Control (TAC)
 * permissions to coexist by creating a different node_access "realm"
 * that merges the node_access rules of both modules
 *
 * From http://drupal.org/node/1355272
 *
 * Thanks for the help and input to agentrickard and BrightBold
 */

/**
 * Implements hook_enable(). 
 *
 * Prompt the site admin to rebuild the node_access table when 
 * this module is enabled.
 */
function domain_tac_enable() {
  node_access_needs_rebuild(TRUE);
}

/**
 * Implements hook_node_access_records_alter().
 *
 * Creates a different node_access "realm" (domain_tac) by merging the
 * node_access settings of the Domain Access and the TAC. modules.
 */
function domain_tac_node_access_records_alter(&$grants, $node) {
  $domain_ids = array();
  $tac_grants = array();

  foreach ($grants as $key => $grant) {
    switch ($grant['realm']) {
      case 'domain_id':
        $domain_ids[] = $grant['gid'];
        break;
      // We treat domain_site as just another domain with id = 'all'.
      case 'domain_site':
        $domain_ids[] = 'all';
        break;
      case 'taxonomy_access_role':
        $tac_grants[] = $grant;
        break;
    }
  }

  // If there are access records for both domain and tac, then we create our own
  // combined record.
  foreach ($domain_ids as $domain_id) {
    foreach ($tac_grants as $tac_grant) {
      $grants[] = array(
        'realm' => "domain_tac_{$domain_id}",
        'gid' => $tac_grant['gid'],
        'grant_view' => $tac_grant['grant_view'],
        'grant_update' => $tac_grant['grant_update'],
        'grant_delete' => $tac_grant['grant_delete'],
        'priority' => 0,
      );
    }
  }

  // If both domain grants and og grants exist for this node, then we are now
  // managing access to this node. Delete their grants from entering the record.
  if (!empty($domain_ids) && !empty($tac_grants)) {
    foreach ($grants as $key => $grant) {
      switch ($grant['realm']) {
        case 'domain_id':
        case 'domain_site':
        case 'taxonomy_access_role':
          unset($grants[$key]);
      }
    }
  }
}

/**
 * Implements hook_node_grants_alter().
 *
 * Based on the new node_access "realm" (domain_tac) it grants or revokes access
 * to nodes while ignoring the original node_access settings in Domain Access
 * and Organic Groups
 */
function domain_tac_node_grants_alter(&$grants, $account, $op) {
  $user_domains = array();
  $user_groups = array();

  // We treat domain_site as just another domain with id = 'all'.
  if (isset($grants['domain_site'])) {
    $user_domains = array_merge($user_domains, array('all'));
  }
  if (!empty($grants['domain_id'])) {
    $user_domains = array_merge($user_domains, $grants['domain_id']);
  }
  if (!empty($grants['taxonomy_access_role'])) {
    $user_groups = array_merge($user_groups, $grants['taxonomy_access_role']);
  }

  foreach ($user_domains as $user_domain) {
    foreach ($user_groups as $user_group) {
      $grants["domain_tac_{$user_domain}"][] = $user_group;
    }
  }
}
agentrickard’s picture

Would be great to package this up and release it as a full module. I can help with that process.

kurtfoster’s picture

OK, so what do I need to do?

agentrickard’s picture

See the instructions at http://drupal.org/node/1011698

If you need a hand, hop on IRC in #drupal-gitsupport or #drupal-contribute

kurtfoster’s picture

Sorry, I am a total n00b to all this and I have not got a response on IRC to my questions. I created a new sandbox project here http://drupal.org/sandbox/LittleGuySolutions/1713066. I then create the ssh keys and added them to my new account. When I try to ssh in I get "PTY allocation request failed on channel 0", I think this may be because I need to use git, I am looking into that now. Any help is appreciated. Thanks.

kurtfoster’s picture

OK, so i went here http://git-scm.com/downloads and installed git, then followed the instructions on the Version Control tab. Getting there.

kurtfoster’s picture

OK, so I think I have made a mess of things now, I have named the module domain_tac, however in GIT it is using the name "Domain Access Taxonomy Access Control Bridge". I unfortunately don't have more time to give to this right now. If someone can give me some pointers it would be great, I only have small chunks of time to come and look into things like this. I would really like to add it as a module to help other people out there, but I just don't have more time to give to this today.

agentrickard’s picture

Go to IRC #drupal-gitsupport for more support. I can't really help with general Git, I was only saying that I can help get your module released.

kurtfoster’s picture

OK, I'll give that ago. I am still intending on doing this, I am just flat out for the moment and will have to come back to this when I have some time. Thanks for your help agentrickard.

kurtfoster’s picture

It has taken a while to get back to this but I have added this module as a sandbox here https://drupal.org/sandbox/LittleGuySolutions/1875420. I guess the next step is to apply for full project access?

agentrickard’s picture

Yes. I can help with that.

kurtfoster’s picture

Hi agentrickard,
the module is only 103 lines long with 3 functions. This does not meet the minimum requirement for review. Can you add it as a project?

agentrickard’s picture

I don't understand the "minimum requirements" comment.

Have you opened an issue to get full Git project status?

kurtfoster’s picture

See point 2.3 in here https://drupal.org/node/1587704. I created the issue anyway, it is here https://drupal.org/node/1876482.

duntuk’s picture

Thank you kafmil, your module seems to work fine--Taxonomy Access Control now works with Domain Access.

agentrickard’s picture

Status: Active » Closed (fixed)

This is now a full module, though it needs a proper release.

https://drupal.org/project/domain_tac

vlooivlerke’s picture

Status: Closed (fixed) » Active
StatusFileSize
new1.51 KB

Hi, I ported your module to D6, find attached.

I have placed it under domain bonus folder in my module install if that could cause problems?
Then I went to module and installed the module, no problem there, it prompts me to rebuild the node access permissions, I do that but nodes show still on all domains.

Is there a specific way to setup TAC? What must the permissions be for anonymous users? Must they be able to Allow (A) or Ignore (I) or deny (D) node access for anonymous users so that nodes show according to domain access?

What happened to domain access when I turned on TAC is that all nodes are now viewable on all domains and sub-domains.

Also see this on the module page: D6 version and how to setup

vlooivlerke’s picture

Status: Active » Closed (fixed)

OK

To make this work, TAC anonymous access must be set to (I) ignore, I just took a big chance om my production site and this module now works great in D6

Thanks

duntuk’s picture

Actually, found out that this module breaks "Publish to:" and requires you to always have "Send to all affiliates" checked, in order to have the content be accessible by anonymous users.

created an issue here: http://drupal.org/node/1927796

*** EDIT ***

This module works fine, "Domain strict" was causing this.

wOOge’s picture

Status: Closed (fixed) » Active

Looks like the module created for this purpose is no longer in development:

https://drupal.org/node/2076755

Any chance for built-in solution?

agentrickard’s picture

Status: Active » Closed (works as designed)

No. It's outside the scope of the core module.