Allow only the users with the access code to browse the website

Question

I am building my site on Drupal 7.

I want to restrict the usage of my website only to certain people who I have sent the access code to. I don't want to put my website into maintenance mode because I want those users to fully use my site (including registration form etc.).

So how can I build a page with a simple form where users will enter the access code and then get allowed to enter the website? And also whenever somebody types in another URL in the website without actually entering the access code first, they must be redirected to the security page to enter the code; then they will be allowed to proceed to that URL they wanted to go to.

I would prefer to be able to remember their sessions and if the user has a session on the website (such that they have entered the code before) they shouldn't be sent to the security page the second time (until their session time ends maybe?).

How can I achieve this?

Answer 1

• create a page, and include the User Login as a block on that page. Theme as desired. You can also set this as a Front page in the system settings if you like.

• alternatively, create a customised user login, whereby the password is populated as part of a custom submit function of the form. Then you would use a Code as the user name, and the password would be automatically assigned. The question is too broad to detail how this would be accomplished. Look into the forms API and building forms with customised submit functionality.

• get LoginToboggan. It has a setting to redirect users to a specified page on access denied

• in permission, for Anonymous Role, uncheck ALL items. This will essentially disallow anonymous user to do anything, or view any content, which should then be redirected to the login page by logintoboggan

Keep in mind that this method is prone to major security breaches by bots. They WILL randomly guess the code and gain access to the site, which is why two fields are required in standard practice (email/user, password)

EDIT FOR OP

I solved it by a custom module. I cant answer my own question due do low reputation so accepting yours as an answer and writing a comment. I created a block, which contains a custom form. This form redirects to home page if the access code is correct and also sets TRUE on $_SESSION['access_code']. And then I created a page and embedded the block In a custom Rule, I redirect user to the access page if $_SESSION['access_code'] is not TRUE and if the user is anonymous whatever the URL it is. So user always redirected to that page, unless they have entered the code before, or a logged in user.

Answer 2

You can try a module called Shield

https://www.drupal.org/project/shield

PHP Authentication shield. It creates a simple shield for the site with Apache authentication. It hides the sites, if the user does not know a simple username/password. It handles Drupal as a "walled garden".

I don't know if it will 'remember the session' but I believe it can help with the other part of you request

Answer 3

Below is the answer (solution) that Shamil.F came up with ...

• This question can be solved by a custom module.
• I created a block, which contains a custom form.
• This form redirects to home page if the access code is correct and also sets TRUE on $_SESSION['access_code'].
• Then I created a page and embedded the block in a custom Rule: I redirect user to the access page if $_SESSION['access_code'] is not TRUE and if the user is anonymous whatever the URL it is.
• So user is always redirected to that page, unless they have entered the code before, or a logged in user.

PS: The comment like "I cant answer my own question due do low reputation so accepting yours as an answer and writing a comment." seems a bit bizarre to me. Which is why I moved it (with some reformatting) to a separated answer.

I don't "expect" any upvotes for doing so, since I mostly posted this extra answer to have it posted as such (an an extra answer). At the risk that the OPer is now going to "change" the accepted answer to this answer ... And even at the risk of this answer being downvoted and/or deleted.

Oh well, so be it, I just wanted to help "clean up" the (pseudo-accepted) answer ... For any other user ever looking at this question, and answer(s).