The use case is a development module that you would only have installed on a local environment.

My thought was to use $config in settings.php to do this:

$config['user.role.anonymous']['permissions'][] = 'use browsersync';
$config['user.role.authenticated']['permissions'][] = 'use browsersync';

When doing this everything looks good in the permissions UI but in practice the permissions seem to be clobbered and permissions like 'access content' are no longer enabled for these users.

  • You can create a module that is only installed on the development environment. That module would add these permissions to the time configuration entities and save them. – Eyal Dec 2 '15 at 5:44
  • *the reason you can't use the config array is that roles are configuration entities that are saved in the database. – Eyal Dec 2 '15 at 5:45
  • Forgive my very basic understanding of CMI but isn't everything in the $config array a config entity of some kind? If not then how do you tell the difference to know what can and cannot be overridden via $config? – Cottser Dec 2 '15 at 10:32
  • Correction: as per the drupal 8 documentation it is possible to override configuration via the $config array in settings.php. I will post a detailed answer with the recommended way to achieve required functionality. – Eyal Dec 2 '15 at 18:55
  • Your suggestion seems to be the correct way to go about this. If it doesn't work for you then it could be a bug in drupal core. – Eyal Dec 2 '15 at 20:53

Permissions are clobbered because Drupal uses NestedArray::mergeDeepArray() to merge overrides with existing config.

For example, if we have this permissions

$ drush cget user.role.anonymous permissions
  - 'access content'
  - 'access comments'

and then add

$config['user.role.anonymous']['permissions'][] = 'use browsersync';

to settings.php, the result will be

$ drush cget user.role.anonymous permissions
  - 'use browsersync'
  - 'access comments'

An easy way to workaround this would be

$config['user.role.anonymous']['permissions'][9999] = 'use browsersync';

which will result in

$ drush cget user.role.anonymous permissions
  0:'access content'
  1:'access comments'
  9999: 'use browsersync'

But if you need to remove a permission via settings.php, then I honestly don't know how to do it, even with module config overrides system (which has an ability to load original config before providing the override). Maybe overriding the unwanted permission with NULL may work, but I haven't tried.

|improve this answer|||||

I'm not sure I completely understand your use case, but think https://www.drupal.org/project/secure_permissions will work for you. It doesn't manage permissions in the settings.php. Instead it allows you to export permission to a hook that can be implemented across several modules. We have a module called cu_debug_admin_bundle that enables devel, disables a few caching related modules. and sets a number of variables for local testing. The module also sets the permission so that devel output is visible to users with specific roles. Ideally that module isn't even deployed to production.

 * Define site permissions in code.
 * Create a secure_permissions_data module directory and place this function
 * in secure_permissions_data.module.
 * @param $role
 *   The role for which the permissions are being requested.
 * @return
 *   An array defining all the permissions for the site.

function cu_debug_admin_bundle_secure_permissions($role) {
  $permissions = array(
    'developer' => array(
      'access devel information',
      'access security review list',
      'run security checks',
  if (isset($permissions[$role])) {
    return $permissions[$role];
|improve this answer|||||
  • Thanks this is for D8 though, and I don't see a D8 version of that module. Was hoping to accomplish this with core functionality in CMI. – Cottser Dec 2 '15 at 2:15
  • Yikes. I wasn't planning on updating secure_permissions to D8 because I thought this type of use case COULD be handled by CMI. – kreynen Dec 2 '15 at 20:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.