2

I've been trying to set up ACL's for a number of different chapters in a national organization's civicrm. The idea is that the secretary for each chapter would be able to access members in that chapter and update their information.

So I 1.) Keep track of who is a member in the chapter through relationships between the members and the organization contact record for the chapter. 2.)Created a smart-group that generates a list of members who have an active relationship with the organization's contact. 3.) Created an ACL group and added the chapter's secretary 4.) Created an ACL Role for the Chapter 5.) Assigned the ACL group for the chapter to it's ACL role. 6.) Created several rules (view the group (which in this case is the smart-group based on the relationships), edit the group, edit custom fields)

However whenever I login as the secretary for that chapter, I am unable to view the members of the chapter, or my own civicrm contact page.

When I do the same with a 'test' login, it works.

I suspect that there is something weird happening because the contact for the chapter's secretary is in the smart-group that I am assigning them to have these ACL rules over.

Has anyone else had this problem? Am I just doing it wrong, or is this some kind of bug?

Thanks, Matt.

Improve this question

2 Answers 2

Reset to default
1

Ah, ok. So I had to enable the " CiviCRM: view my contact" and "CiviCRM: edit my contact" fields under Drupal People -> Permissions. Then if they are in the smart group I'm giving access to, they can see themselves.

Improve this answer
2
  • Good sleuthing but do i take it they will see themselves whether they are in the Group or not now?
    – petednz - fuzion ♦
    Commented Mar 9, 2016 at 21:43
  • I suppose they will. Which works fine for what we are doing - the idea is each member will be able to edit their own info, but chapter leaders will be able to edit the info for members of their chapter. I could imagine that some people using civicrm would want to limit some users from editing their info unless they were part of xyz group and given an ACL, but not me.
    – Matt Muchowski
    Commented Mar 11, 2016 at 0:25
0

In case you need to find an alternative recipe, this one is based on Relationships so does not involve making ACL Groups.

Download the Permissioned Relationships extension (and read instructions about its dependency on CiviCRM Entity Settings).

When the above extensions are enabled, on any Relationship Type you should now see a new field saying Always Permission A to B (and vv). And at civicrm/admin/setting/misc?reset=1 you should see an option for 'Allow second-degree relationship permissions' (ie so A can see B, and if B can see C, D and E, then A can see C, D and E).

Make a Relationship Type xxx and set it to be 'always permissioned.

Make a CMS role that does not have "view/edit ALL contacts"

Give Joh that role, and set him as a 'xxx of' for MYORG, and set MYCO as a permissioned relationship of 'yyy' for Mary and Bob and Jane.

Then John will be able to only see Mary and Bob and Jane, and not other contacts who do not have that relationship to MYCO

Improve this answer
8
  • That extension looks cool, but it's pretty outdated. It wants to run on civicrm "4.4.6+ (but not 4.5 at this stage )" but we're already running 4.6.10
    – Matt Muchowski
    Commented Feb 11, 2016 at 21:16
  • we have it running on 4.6. x without any issues
    – petednz - fuzion ♦
    Commented Feb 14, 2016 at 19:55
  • Ok, so I used the 'include / exclude' search. Included the smart-group for the chapter, excluded the 'acl' group for the chapter secretary. Then I saved this as a new smart-group. In the ACL settings, made the acl role for the chapter, added the group for the chapter secretary to the role, then gave that role control over the new 'include / exclude' smart group that we created. Gonna tinker a little more with specific acl settings, but I think this will work for us. We have a lot of chapters, so there will be a lot of acl's, but oh well.
    – Matt Muchowski
    Commented Feb 17, 2016 at 2:19
  • Good luck. The relationship approach i flagged above takes care of that all automatically in case you end up thinking the ACL approach is to burdensome
    – petednz - fuzion ♦
    Commented Feb 17, 2016 at 4:26
  • @petednz-fuzion, have you tested this on 4.7 yet? Could potentially solve civicrm.stackexchange.com/questions/9755/…
    – G H
    Commented Feb 19, 2016 at 15:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.