IDs that previously were able to use CiviCRM now get 'Access denied - You are not authorized to access this page.'. (i.e. /civicrm/dashboard) These Ids can log in to Drupal. I may have caused this with some Role permission changes. I've fiddled with many of the Role permissions to no avail. We use ACLs to limit access to contact records.
What's the necessary subset of Drupal Role permissions to gain access to CiviCRM?
Drupal 7.61 CiviCRM 5.9.0
I solved this with trial and error. I had to grant access to :
CiviCRM: access CiviCRM backend and API Master control for access to the main CiviCRM backend and API. Give to trusted roles only.
I'm having trouble believing that this is really a basic setting for access to CiviCRM, since it's flagged as 'trusted roles only'. I'm not clear what's covered by the term 'CiviCRM backend and API'. What function(s) within CiviCRM require this Permission?
We had the same issue and same resolution, but agree, it doesn't feel right. I opened an issue in the lab but couldn't find anything else: https://lab.civicrm.org/dev/drupal/issues/45
EDIT: Maintainer/owner "colemanw" replied to the issue:
Looks like "access CiviCRM" was recently renamed "access CiviCRM backend and API" I assume to enhance clarity but it seems to have caused some confusion. But it's true, you should only allow trusted users to access your CRM.
EDIT2: More info from colemanw:
Right, "access CiviCRM" or whatever it's called now is the gatekeeper, the minimum permission needed to access any part of CiviCRM. It is required to have that permission before doing anything.
Looks like we had the right idea!
