How do I override LoginTobbogan so that it redirects to Front Page on 403?

Question

We have a Commerce Kickstart 2 site using LoginToboggan.

What we want is this: if an anonymous visitor goes directly to a node which is unpublished we want them to be redirected to the front page.

We do NOT want them to get a 403 (Access Denied) or to see a login form ... which seem to be the only two options available.

I've tried using Rules, but unfortunately Logintoboggan seems to take precedence over Rules.

Is there a way to override Logintoboggan's 403 behaviour?

OR is there another login module we can use which allows for login by either user name OR e-mail address that doesn't hijack 403? (That's basically the only reason we're using LT--people have gotten used to using e-mail addy to login.)

Answer 1

Option 1: Use the CustomerError module

As per the "... is there another login module ..." part of your question, you may want to look at the CustomError module. Here is a quote about it (from its project page):

... allows the site admin to create custom error pages for HTTP status codes 403 (access denied) and 404 (not found), without the need to create nodes for each of them.

Main features:

• Configurable page title and descriptions.
• There are no author and date/time headers as with normal nodes.
• Any HTML formatted text can be be put in the page body.
• The error pages are themable.
• Users who are not logged in and try to access an area that requires login will be redirected to the page they were trying to access after they login.
• Allows custom redirects for 404s.

More specific, related to the LoginToboggan module, this is how the CustomError module integrates with it (quote from its README.txt, bold markup added here):

If this module is enabled, it can enhance CustomError's handling of access-denied messages, but you have to be careful to set them up to work together correctly.

These two modules both attempt to take over handling of system 403 ("access denied") messages, and can conflict. CustomError does it by asking you to go to "admin/config/system/site-information" and manually setting the "Default 403 (access denied) page" to "customerror/403", whereas LoginToboggan sets that same field to "toboggan/denied" automatically (overwriting any other value that was there), when you enable its "Present login form on access denied (403)".

If you are using CustomError with LoginToboggan, you should allow LoginToboggan to perform this take-over (in other words, don't set the "Default 403 (access denied) page" to "customerror/403"). This way, if someone attempts to access a page that they don't have access to, LoginToboggan will first give them a chance to log in if they haven't yet. If they still don't have access to the page, CustomError then takes over from LoginToboggan (by overriding one of its theme functions), displaying its customisable messages for access-denied errors.

So using what is described in this last (bold) sentence, you may get it to work the way you'd want to (or at least come closer to the solution you're looking for).

Option 2: Retry with the Rules module

Your (failed) attempt to use the Rules module, might be because you have NOT used event "Drupal is initializing". You may want to retry, using this "Drupal is initializing" event. That might help to ensure that the rule gets trigger 'BEFORE Logintoboggan has a chance to take precedence' (so that you are NOT too late).

For a sample of a Rule (in export format) using this "Drupal is initializing", refer to my answer to the question "How to redirect user using Rules when user visits a link with view?".