TIAA Users, Roles & Permissions Guide

by | Jun 19, 2014

Summary

One of the great features of Drupal is the ability to control who can see what content on your site. You do this by setting permissions for roles and then assigning those roles to your users. Two methods are used on tialumni.org to control permissions.  First, the default Drupal permission and role system provides broad spectrum control of every functional aspect of the site. This includes permissions for the functional aspects of CiviCRM.

The Drupal permission system  processes are very flexible, so content view/edit/create/delete access can be set broadly at the content type level.  In addition, we have employed a powerful contribution module, Content Access,  to further control view/edit/delete content permissions refined down to the node (individual page) level.

 

Drupal Users, Roles, and Permissions

 

Definition of Terms

 

There are 3 main types of roles for users in Drupal:

  1. Anonymous – site visitors not logged in
  2. Authenticated User – site visitors logged in
  3. Administrator – logged in users who have access to everything and can grant access to anything.

 

The other roles defined for the site are custom roles set up by developers to handle specific use cases requested by the owners of your site. As a guideline, here are the primary roles (both custom and standard) that are built into your site, with the broadest access at the top and the most limited access at the bottom:

  1. Administrator
  2. Site Admin
  3. Staff Admin
  4. Executives
  5. Member
  6. Authenticated User
  7. Anonymous

 

There are additional roles with more specialized permissions, but they are intended for use in the site design and should only be modified by developers.

 

How to Administer User Roles & Permissions

 

At a high level the process for administering permissions on your site is:

  1. Verify which roles have the permissions required by the user
  2. If the existing roles do not adequately cover all the user’s required permissions, a  Site Admin  should first try adding the missing permissions to existing roles. The key here is to not grant more access to a  role than all the users with that role should be allowed (avoid violating any of the permission restrictions intended by the site owners).
  3. If the existing roles cannot cover all the required permissions, a new role may be needed. Although Site Admins have the ability to create new Roles, it is recommended that a Skvare developer be consulted before a new one is created.
  4. Assign the user to one or more roles which collectively allow all the needed permissions.

 

To view/update any of the existing roles and their permissions, on the Admin Menu go to People – Permissions. Note that there are so many roles, you must scroll horizontally to view the ones hidden off the screen. To add or remove a permission from a role, simply toggle the checkbox in the appropriate row and column.

 

To edit the permissions for an existing user:

  1. Click Search – Find Contacts on the CiviCRM menu
  2. Find the user, click on the user’s name to open the Contact Summary page
  3. If the user has a Drupal account (required for granting them roles) click their User ID link which is to the right of their CiviCRM id (see Screenshot below)
  4. On their Drupal User page, select Edit > Password and scroll down to Roles and check the required roles
  5. Click Save to save and close the page..

Creating new Roles

 

If the user cannot get all the required permissions based on the existing roles, and the existing roles cannot be granted additional permissions without violating the site’s core permission restrictions, it is preferred that you ask a developer to create a new role with the appropriate permissions. Roles can get overly complicated very quickly and a developer can help make sure roles remain clear, efficient and do not conflict with the site design.

 

If you decide to create a new role without the guidance of a developer, you can:

  1. Go to People – Permissions, and then click Roles.
  2. Enter a name for the new role in the field beneath the existing roles.
  3. Click Add role.

 

The new role will be saved in the list and then you assign it permissions using the same procedure described above — On the Admin Menu go to People – Permissions.

 

Basic Rules for Administering User Roles & Permissions

 

  1. The Administrator Role should only be assigned to Skvare (developer) resources.
  2. Permissions granted to an authenticated user are inherited by all roles that require authentication. For example,administrators automatically inherit authenticated user permissions because the administrator role requires the user log in.
  3. Be cautious when granting certain permissions that could damage the site if used improperly. Make sure the users granted these permissions are trained and comfortable with how to use them. In general, CiviCRM permissions should not be changed, in particular, avoid changing CiviCRM permissions such as:
    1. Administer CiviCRM
    2. Edit all contacts
    3. View all contacts
  4. Be cautious when granting access to Masquerade permissions such as:
    1. Masquerade as admin
    2. Masquerade as user
  5. Be cautious when granting Node access to “Bypass content access control.” This allows users with that role to do anything with your content.
  6. Heed any warnings that appear beside a permission such as “Warning: Give to trusted roles only; this permission has security implications.” Examples of these include but are not limited to:
    1. User – Administer Permissions
    2. System – Administer Site Configuration
    3. View – View Access Control

 

Before changing any of the permissions mentioned above, or with warnings messages, we recommend you consult with a Skvare developer.

 

Creating New Users

 

  1. On the Drupal Admin Menu go to People – Create User
  2. Give the user a username, email address, password
  3. Leave the status as Active. Blocked can be used when you want to prevent a user from logging in but still want to keep them in the system.
  4. Grant the user the appropriate roles based on the desired permissions
  5. Be sure to check the box for “Notify user of new account.”
  6. The “Name and Address” and “TIAA Member Profile” sections will be linked and used to create the user’s CiviCRM account.
  7. Click “Create New Account” to save and close the document.

 

Deleting Users

 

Be aware that before deleting a user, you must decide what to do with any content that user had created. You will need to decide if you want to disable or delete the account. If you disable the account, you must also decide if you  want to keep or unpublish the content. If you choose to delete the account you must decide if you want the content to be switched to Visitor or deleted along with the user account.

 

To delete a user:

  1. Open the user document
  2. At the bottom of the document, click “Cancel Account.”
  3. Select the appropriate option in the field called “When Canceling the account” (See Screenshot below).
  4. Click “Cancel Account” at the bottom of the page.

Per node Content Access

 

The Content Access module has been enabled on your site to allow more finely tuned permissions on a page by page basis. In Drupal, we refer to web pages as nodes. Although the permission is set on the individual node, the permission will still be granted to roles defined for the site . These individual node permissions are in addition to the permissions already granted by the broader, role based permissions previously discussed.

 

Presently, only Admins and Site Admins have the ability to set permissions at the node level. To set permissions at a node level, an authorized user will:

  1. Open the node.
  2. Click the Access Control tab
  3. Choose the supplemental permissions to be added and checks the roles to be granted those permissions
  4. Click the Submit button to save the changes.

 

Masquerade


 

The Masquerade module has been enabled so you can switch to/impersonate another user as you navigate around the site to test their permissions. To use it, just type the username in the field under the Masquerade label in the left nav bar on the homepage and click Go. To revert back to your regular access, click the “switch back” link that displays below the Masquerade label while you are impersonating someone else.

 

Presently, the only 3 roles with permissions for Masquerade are:

  1. Administrator
  2. Site Admin
  3. Staff Admin