2

It seems using ACLs to limit access to contacts is a hot topic. I've reviewed many of the questions on the topic, many years old, but have yet to find a solution. Scenario is:

• Our Federation has direct members (paid) and 52 member clubs (free).

• Each club can have hundreds of their own members and club members inherit a membership to the Federation through their Club.

• I am trying to create a login controlled by an ACL that limits a Club Admin to viewing, editing and creating only their own members.

• Clubs in Wordpress are assigned the Club Admin User Role with permissions for CiviCRM.

• I've put the Club contact type 'Organization-Member Club' into a group 'Clubs'

• I've created a Club Admin Role assigned to the group Clubs.

• I'm creating an ACL for each specific club using the Club Admin Role, allowing 'Edit' on 'group of contacts' data assigned to the specific club group

• Tried creating a 'Smart Group' on search for specific club Membership which finds the memberships but doesn't allow Access Control, only Mailing List.

The only results I can get when logged in as a Club Admin user is a listing of all Contacts, if I have 'view all contacts' in the WP permissions — if I don't have that permission, I get nothing. I've been through many, many combinations of permissions, roles, groups, relationships, memberships and ACL settings. Is there not a solution that doesn't require creating multiple entries in separate tabs? This seems like a pretty common requirement for multi-level organizations, what am I missing?

Improve this question

2 Answers 2

Reset to default
1

I had a scenario similar to yours, and I have found the solution in CMS permissions using the related permission extension. CMS permissions are above ACLs rules. So before to create ACLs rules, check your CMS permissions and verify that you don't allow your "Admin club" to see all contacts. In our case, we define that "Admin club" cannot view AND edit all contacts, and in ACLs, we define "Admin club" can only see his club contact through the related permission.

It took us a few time to understand that it's an option in the dropdown select menu for 'Custom Fields' (here, 'Données personnalisées'). .

enter image description here

Improve this answer
0

I am trying to create a login controlled by an ACL that limits a Club Admin to viewing, editing and creating only their own members.

The Permissioned Relationship extension makes an ACL based around the relationship and could provide what you need. We use it in many scenarios similar to yours

One write up about it is here

Improve this answer
2
  • petednz, thanks. I am hoping there's a solution that doesn't require having to add the contacts to groups or relationships as extra steps on top of adding them to a membership.
    – Scarlett
    Commented Aug 3, 2021 at 2:28
  • "Each club can have hundreds of their own members and club members inherit a membership to the Federation through their Club" - i assumed you already had relationships working - and if you do then this should not require any additional ongoing work, other than also added a Club Admin to Club relationship, which could be a Caldera form so it could potentially be self-managed i think
    – petednz - fuzion ♦
    Commented Aug 3, 2021 at 2:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.