4

IDs that previously were able to use CiviCRM now get 'Access denied - You are not authorized to access this page.'. (i.e. /civicrm/dashboard) These Ids can log in to Drupal. I may have caused this with some Role permission changes. I've fiddled with many of the Role permissions to no avail. We use ACLs to limit access to contact records.

What's the necessary subset of Drupal Role permissions to gain access to CiviCRM?

Drupal 7.61 CiviCRM 5.9.0

Improve this question
7

We had the same issue and same resolution, but agree, it doesn't feel right. I opened an issue in the lab but couldn't find anything else: https://lab.civicrm.org/dev/drupal/issues/45

EDIT: Maintainer/owner "colemanw" replied to the issue:

Looks like "access CiviCRM" was recently renamed "access CiviCRM backend and API" I assume to enhance clarity but it seems to have caused some confusion. But it's true, you should only allow trusted users to access your CRM.

EDIT2: More info from colemanw:

Right, "access CiviCRM" or whatever it's called now is the gatekeeper, the minimum permission needed to access any part of CiviCRM. It is required to have that permission before doing anything.

Looks like we had the right idea!

Improve this answer
6

I solved this with trial and error. I had to grant access to :

CiviCRM: access CiviCRM backend and API Master control for access to the main CiviCRM backend and API. Give to trusted roles only.

I'm having trouble believing that this is really a basic setting for access to CiviCRM, since it's flagged as 'trusted roles only'. I'm not clear what's covered by the term 'CiviCRM backend and API'. What function(s) within CiviCRM require this Permission?

Improve this answer
0

I still wonder, why there is no distinction between getting access to the CiviCRM backend and getting access to API?

For some users, this permission might be a bit too much, because having access to API Explorer allows you to perform data manipulations of all kinds.

Does anybody have an answer or explanation?

Improve this answer
  • Found the answer myself: the API explorer has its own permission system. Having the "access CiviCRM backend and API" does not give you access to deleting or updating records. When you try it, you will receive error codes saying you are not authorized. So all o.k. – user7094 Nov 30 '20 at 13:39
  • 1
    If you have a new question, please ask it by clicking the Ask Question button. Include a link to this question if it helps provide context. - From Review – William Mortada Dec 8 '20 at 20:56
  • Andrea - do you want me to convert this to a comment, or will you remove it? – petednz - fuzion♦ Dec 10 '20 at 18:48
  • I'd think it might be helpful for other people who stumble across this? – user7094 Dec 14 '20 at 8:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.