Can't access custom fields used in event registration

Question

Versions:

• Drupal 7.63
• CiviCRM 5.9.1

Custom Fields:

• Created custom fields with Field Type of Autocomplete-Select with lookup for following fields:

  • Institution
  • Area of Study
  • Year of Graduation

• Used for: Participants (Role): Attendee

  Attendee is a type of participant for an event type, alongside other types

  • Custom Data Set is active
  • Custom Data Set is public

Custom fields are to be used by CiviEvent attendees to self select as part of event registration, this information is saved against their contact entry.

Drupal Permissions

• "CiviCRM: access all custom data" is active for Anonymous User role

Problem

When typing in a valid value for the custom field, such as "Accounting" for "Area of Study" the following error of "Loading Failed" is displayed for an unauthenticated user.

This lookup works fine with the following Drupal Role Permission assigned:

• CiviCRM: access CiviCRM backend and API
  • Master control for access to the main CiviCRM backend and API. Give to trusted roles only.

I've been unable to find more information about the security implications of this setting, and the wording of this setting concerns me when thinking to giving it to Anonymous Users.

I'm trying to get the balance of functionality without leaving the system too open, but I'm unsure why I need to expose access to the backend and API to get this working.

When the following Drupal permission is modified: (thanks @petednz)

• "CiviCRM: access AJAX API" is active

  • The error message in a cell such as "Area of Study" upon searching an area such as "Accounting" is "None Found" (error has light great background instead of red background per image above)

• "CiviCRM: access AJAX API" is inactive

  • The error message in a cell such as "Area of Study" upon searching an area such as "Accounting" is "Loading Failed" (error has red background per screenshot above)

Answer 1

I'm working on this with @zoog and can confirm that the autocomplete only works when 'CiviCRM Backend and API' permission is granted to anonymous. However changing it to an ordinary select works without this permission. Seems independent of 'access AJAX API' which remains granted. What do you think @petednz-fuzion - have you got autocomplete work for anonymous?