I have several nodes where I need per-user access control. I know how to do that by enabling per node access control and going to the access tab in the node.

But it looks like that's for adding users one at a time. I'd like to instead add users based upon a particular value in a custom profile field. So any user that has the value of ABC in the custom profile field of XYZ would have access to the node.

Is this possible? Should I be doing this differently?

CommentFileSizeAuthor
#9 rules.png44.02 KBLloyd

Comments

Lloyd’s picture

Lloyd commented
Title: CA + ACL - Easy way to add a group of users? » CA + ACL or Rules - Easy way to add a group of users?

So I think this problem is best served by using Rules along with Content Access. But I could use some help in figuring out the rule configuration.

The content type for the pages in question is "Commission Page". There is a page with the title Commission Schedule that generates the title-raw of "commission-schedule".

I have a custom profile field that generates the token "[user:profile_commission-schedule]". One of the values that can be selected is "schedule".

So, I tried to create a rule based upon the following two conditions:

1. Textual Comparison: commission-[user:profile_commission-schedule] in one box and [node:title-raw] in another. No other options are selected on that conditions page. I'm not sure but I left the "regex" unchecked.

2. Viewed content is type "Commission Page"

It seems that #1 should be true in my test case since it should be comparing "commission-schedule" generated by combining "commission-" and the token from the user profile to the node title-raw which should be "commission-schedule". And the content type is certainly Commission Page. So the conditions should be met.

For actions, I used "Grant Access for Acting User" with content "viewed content" selected and "view" access granted.

But, it doesn't work. What should I be doing differently?

salvis’s picture

salvis
he/his
commented

I think your chances to get a response would be better if you moved this to the Rules queue.

Lloyd’s picture

Lloyd commented

It looks like the rule is created correctly. I used rules debug and there are no problems. However, it works for an administrator but not for someone in a different role. I'm not including anything role-related in the rule so I have to believe it's something to do with CA or permissions.

I know this is quite vague but what should I be looking for to figure out the problem? I do not have this role checked on the node's access control as I believe that would give access to everyone with the role which defeats the purpose. And the role does not have Grant Content Access permission in Permissions but I believe that's correct as well.

salvis’s picture

salvis
he/his
commented

Have you installed Devel Node Access and looked at the misbehaving node yet?

Lloyd’s picture

Lloyd commented

I haven't done that but can. Is there something in particular that I should look for?

salvis’s picture

salvis
he/his
commented

Post a screenshot of both DNA blocks for one node that is misbehaving.

Without that information, we're shooting in the dark.

Lloyd’s picture

Lloyd commented

Regarding DNA, do I need to be logged in with a role having an issue for the information to be of any value? when I ran it under admin it just confirmed that I had access, and simply said that my test account did not. I couldn't see any information as to why.

salvis’s picture

salvis
he/his
commented

No, most of the information is independent of the current user, as long as you can see the node (and the two DNA blocks in Debug mode) of course.

Lloyd’s picture

Lloyd commented
StatusFileSize
new rules.png44.02 KB

Cool. Here's a screen shot. Hopefully there's enough info here. As I said, the rule seems to be working just fine as when I test it as the administrator it passes the Rules debug test. And it adds my admin user to the access list. But when I access as someone other than an administrator access is denied, and the user has the same setting as the admin in the custom profile field. So access should be granted.

salvis’s picture

salvis
he/his
commented

Is your test user Mike or Lloyd? The others seem to have View access.

Now, can you manually configure that same node so that it has the permissions that you'd like to have? What will the DNA information look like then?

Lloyd’s picture

Lloyd commented

the test user is Lloyd. I can add that user to ACL and it will be identical to one of the other Lloyd's. FYI I'm using the realname module here so it can seem like there are duplicate names. Not sure if there's a conflict with Realname and CA. I guess the worst case scenario is to just use ACL. I'll have to add a couple hundred users and then manually update it when more come, but it will at least work. That's the weird thing. The rule tests fine when I run it as an admin (I haven't been able to figure out how to run Rules debug as a non-admin user). I can add someone manually to ACL. But when I try to give them access via the rule, and they are not an admin, I get access denied.

Lloyd’s picture

Lloyd commented

the test user is Lloyd. I can add that user to ACL and it will be identical to one of the other Lloyd's. FYI I'm using the realname module here so it can seem like there are duplicate names. Not sure if there's a conflict with Realname and CA. I guess the worst case scenario is to just use ACL. I'll have to add a couple hundred users and then manually update it when more come, but it will at least work. That's the weird thing. The rule tests fine when I run it as an admin (I haven't been able to figure out how to run Rules debug as a non-admin user). I can add someone manually to ACL. But when I try to give them access via the rule, and they are not an admin, I get access denied.

salvis’s picture

salvis
he/his
commented

I don't think realnames has anything to do with it.

content_access/view_402: lloyd_silver, lloyd_client

shows two of the Lloyds, but not the third one. It seems that if you can get two in, a third one should just be 'more of the same'...

But when I try to give them access via the rule, and they are not an admin, I get access denied.

Do you really mean you get access denied when trying to give them access, rather than when trying to view the node?

That would obviously depend on who is trying to run the rule. If the account trying to run the rule does not have access to the node, then they are not supposed to have access to the node. This is correct behavior.

jessehs’s picture

jessehs
he/him
Primary language English
Location Taos, New Mexico
commented
Version: 6.x-1.2 » 7.x-1.2-beta2
Issue summary: View changes

Updating to 7.x since this issue still exists.

jessehs’s picture

jessehs
he/him
Primary language English
Location Taos, New Mexico
commented

I was able to accomplish this with a custom PHP action. The following snippet works for an entityreference field "studio_teachers".

// Grant teachers access to edit this node.
if (module_exists('acl')) {
  // Saves content access settings per node if it's not already set up.
  $settings = content_access_get_per_node_settings($node);
  if (!$settings) {
    $operations = _content_access_get_operations($node->type);
    foreach ($operations as $op => $label) {
      $settings[$op] = content_access_per_node_setting($op, $node);
    }
    content_access_save_per_node_settings($node, $settings);
    // Add the settings to the static cache ($op is ignored in this case).
    content_access_per_node_setting($op, $node, $settings);
  }
  module_load_include('inc', 'acl', 'acl.admin');

  // Create/update acl_ids, add records to acl_node table.
  $acl_id = content_access_get_acl_id($node, 'delete');
  acl_node_add_acl($node->nid, $acl_id, 0, 0, 1);

  $acl_id = content_access_get_acl_id($node, 'view');
  acl_node_add_acl($node->nid, $acl_id, 1, 0, 0);

  $acl_id = content_access_get_acl_id($node, 'update');
  acl_node_add_acl($node->nid, $acl_id, 0, 1, 0);

  foreach ($node->field_studio_teachers['und'] as $target) {
    $uid = $target['target_id'];
    $user = user_load($uid);
    $users[$uid] = $user->name;
  }
  $acl_form = array(
    'acl_id' => $acl_id,
    'user_list' => serialize($users),
  );
  // Sets per-user access based on teacher field.
  acl_save_form($acl_form);

  // Apply new settings.
  node_access_acquire_grants($node);
}

EDIT: There was a bit more logic to apply the acl settings for nodes that have not had the content access setting form saved before.

gisle’s picture

gisle
he/him
Primary language Norwegian Bokmål
Location Norway
commented
Version: 7.x-1.2-beta2 » 7.x-1.x-dev
Status: Active » Closed (outdated)

This issue has not received any updates in the previous 6 years. If you believe it to still be relevant, you are encouraged to reopen the issue and update it.

If you got an email about this Issue status update, it is because you at one time (possibly a very long time ago), subscribed to it. To learn how to unsubscribe yourself, please visit: https://www.drupal.org/project/webmasters/issues/3142987