I have a config entity that I would like to grant access to on a role based level. There is going to be one role to access the entities, but how can I assign access on a per entity basis?

My naive thinking is to add a $roles array instance variable, and add each individual role to that, then create a custom EntityAccessControlHandler class, implementing EntityAccessControlHandlerInterface that checks the array for all of the users roles, but that doesn't seem like a very good solution.

  • 1
    Using your own access handler is a perfectly valid approach. Although if it is role-based why don't you use permissiona as usually?
    – user21641
    Commented Oct 22, 2015 at 19:01
  • Won't default behavior grant access to all entities, not just each instance of an entity? These are going to be used for authenticating to private directories and I can't have people accessing files that they don't have explicit permissions to view.
    – Steven
    Commented Oct 22, 2015 at 19:06

1 Answer 1


but that doesn't seem like a very good solution.

Yes, it is.

What you're saying makes perfect sense, just do it :)

access() (or checkAccess()) is called for each entity separately, you can implement any imaginable logic in there, that's completely up to you.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.