I'm trying to set up a read-only role in CiviCRM on Drupal. The environment is Drupal 8.9.12, CiviCRM 5.32.2 on Centos 8 with Apache. This is a brand new installation I'm setting up for an organization that I volunteer for. (I'm new to CiviCRM but have a long career with the IT industry and Linux in particular.) Right now I'm working on a test environment that I've set up for learning my way around.

I've created a role in Drupal and enabled a number of CiviCRM "view" permissions in this role. I've then created a used and assigned the newly created role to this user.

If I log in as this user I get "Access denied" for everything I've tried. If I now enable "CiviCRM: access CiviCRM backend and API" for this read only role, I can now see the CiviCRM pages but I also seem to ave the ability to edit, which I'm trying to prohibit.

This is all on a virgin install. I didn't encounter any problems installing the software, and if I log in as a user with adminitrator permissions everything works as expected, so there doesn't seem to be a problem with the install.

Any ideas?

Thanks, Martin

  • For view-only, you might want to think about doing it as drupal views (via drupal.org/project/civicrm_entity for drupal 8).
    – Demerit
    Jan 18, 2021 at 19:08
  • Thanks, I'm looking at this but it seems like a lot of work for providing what seems to be already catered for. I have to wonder if the built in CiviCRM/Drupal roles implementation is buggy...
    – MartinH
    Jan 18, 2021 at 19:50
  • It's just read-only is an unusual setup for CiviCRM's "backend" screens. You might be able to do it with ACLs. See docs.civicrm.org/user/en/latest/initial-set-up/…
    – Demerit
    Jan 18, 2021 at 20:05
  • OK I figured it out. The "edit" capability was set for Authenticated Users. Moral: always check Authenticated users. The default settings may not be what you want...
    – MartinH
    Jan 18, 2021 at 20:29
  • Ok great! You can answer your own questions on stackexchange by filling out the answer field below - it's encouraged even.
    – Demerit
    Jan 18, 2021 at 20:32

1 Answer 1


So it turned out that the "Contact edit" capability was turned on for the "Authenticated User" role. One needs to remember that Drupal "ORs" the permissions for logged in users in any custom role with the permissions in the "Authenticated User" role.

Always check the defaults before blaming the software!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.