Is Taxonomy Access Control compatible with Content Access in D7? Based on other issues here, they are not compatible in D6, but I'm less sure about D7. Any of you using both of them together successfully, or have you tried and failed?

Comments

good_man’s picture

good_man commented

Can you test them both and report the results here?

dhalbert’s picture

dhalbert commented
Title: Compatible with Taxonomy Access Control? » Compatible with Taxonomy Access Control? [answer: NO]
Status: Active » Closed (works as designed)

I did a systematic test, and the short answer is that using them together is dangerous.

For brevity:
TAC = Taxonomy Access Control
CA = Content Access

Two tests:

  1. I set a content type CT1 so View access is denied to anonymous users by a taxonomy term using TAC. When I enable both TAC and CA, and allow View access to anonymous users via CA, then CT1 nodes are visible to anonymous users, despite the TAC settings. If I turn off View access for anonymous users in CA, then access is denied.
  2. I set a content type CT2 so that View access is denied to anonymous users by CA. It does not have any taxonomy fields. When I enable both TAC and CA, the CT2 nodes are visible to anonymous users, despite the CA settings.

So access must be denied by both modules to make sure it is really denied. That's not a very useful operational requirement. So I would say that TAC and CA are not compatible.

UPDATE: This is well explained as an inherent property of D7 access control in the documentation for TAC: Background information: Grants are additive. If any access control module grants access, then access is allowed. The least restrictive access is the one that prevails.

dlx’s picture

dlx commented

If in Structure > Content type > Content Access > Advanced - "Give content node grants priority" is set to a higher than TAC number, the modules work together as expected.

rjacobs’s picture

rjacobs commented
Title: Compatible with Taxonomy Access Control? [answer: NO] » Compatible with Taxonomy Access Control?

Understanding the "additive" nature of grants across various access control modules seems to be the key point here. Though it can be a bit cumbersome, it does appear to be possible to get TAC and CA to play nicely together by ensuing one module is configured to ignore controls for a given piece of content that the other one applies rules for. Using the grants priority, as dlx pointed out, is one way to do this, but carefully using "ignore" settings offered by TAC is another. For some puzzling reason the default "global" view settings that TAC applies for anonymous and authenticated users is "allow", which means it will typically give an overriding "grant" permissions to content that you may otherwise want to "deny" view access to with CA (the reverse is also possible of course). Changing these global TAC view settings to "ignore" also made things work in a much more expected way without changing the grant priory.

Anyway, we are still experimenting with having TAC and CA installed side-by-side, but I did feel it prudent to change the title, as stating "Answer: NO" there seems a bit misleading for people scanning the issue queues (even though this issue is no longer active).