As far as we all know Drupal (still in D8) has a lot of issues with permissions and taxonomies.

So I give my user role the permission to Administer vocabularies and terms so he/she be able to access the page at admin/structure/taxonomy but then I want to restrict that role to certain vocabularies (then Vocabulary Permissions Per Role module comes in handy)

The only issue that remains is the Add Vocabulary permission that comes with Administer vocabularies and terms

So here's the question: How can I restrict the user from Creating new vocabulary / Editing existing vocabularies while giving access to maintain other vocabularies taxonomy terms?


"Creating a new vocabulary" is what you do using the URL admin/structure/taxonomy/add, while "Editing existing vocabularies" (say with machine name demotags) is done using the URL admin/structure/taxonomy/demotags/edit.

A possible solution to "restrict" access to these URLs (which seems to be the missing piece you are looking for) is to use the Rules module for this. To do so, have a look at my answer to the question "How to make the permissions of a module more granular?". It includes a rule (in rules export format), which you should be able to use if you apply these minor tunings to it:

  • Check the Rules Condition about which roles this validation should be applied for (if any, if not remove that condition).
  • Adapt the Rules Condition with the URLs containing visitors (to match the taxonomy related URLs like in my first paragraph).
  • You probably don't need the Rules Condition with the "regex" in it (you only have a few URLs to be validated). In that case, you don't need the "OR" part either.
  • Review the Rules Action (the message you want to show, and the redirect you want to force).
  • Thanks Pierre for the answer, but there are couple of issues with this approach and that's the UI, when the user goes to admin/structure/taxonomy he still sees the "Add a new Vocabulary" and Edit the Vocabulary links which is not the perfect thing, I wonder if there is a way around it that we actually restrict the role from doing those things instead of just blocking his access to the URL – user23288 Mar 14 '16 at 11:40
  • I can see your (new) point (your question said "restrict", right?). But to also make that part work (= hide those links), you might want to try to also hide it using an approach similar to what is shown in the answer to "drupal.stackexchange.com/questions/142355" (with roles that fit your needs, and your URLs). Even though I personally don't like putting "logic" in a template, I can't think of another solution for that part. And I'd love to see another answer that would also address this extra requirement (to learn from it myself). What do you think? – Pierre.Vriens Mar 14 '16 at 11:52
  • I guess since there's no generic permission approach for this we have to hack the template files + your sultion. which in my opinion is just a dirty hack and not a proper solution, even though it works just fine! anyways thanks for your answer, I'll set it as the correct answer since there's no other valid solution I guess to cover it all. – user23288 Mar 14 '16 at 13:11
  1. Create a new permission called for example 'Add new vocabulary'
  * Implements hook_permission().
   function YOUR-CUSTOM-MODULE-NAME_permission() {
      $permissions = array(
        'add new vocabulary' => array(
          'title' => t('Add new vocabulary'),
      return $permissions;
  1. Alter menu admin/struture/taxonomy/add 'access arguments'
  * Implements hook_menu_alter().
   function YOUR-CUSTOM-MODULE-NAME_menu_alter(&$items) {
   $items['admin/structure/taxonomy/add']['access arguments'] = 
    array('add new vocabulary');
  1. From admin/people/permissions you will find your new permission 'Add new vocabulary' under your YOUR-CUSTOM-MODULE-NAME, and give it only to your desired roles.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy