I have a Drupal 7 site on a server wich can be accessed by 2 differents Network (A and B). On both Network I use SAML to authentificate the users and affect them their roles (including back office roles) with SAML attributes. When an user logs in from network A to my site he must have his back office options but when he logs in from network B he must not have them.
I want to block any administration feature, not just back office access so blocking urls will not be enough. I don't want to see the edit/view tabs on content in the front office. I don't want them to have access to content that is not published (even if they have access to it on network A). Like the users had no back office role at all when they are on network B.
I am able to detect wich network the user is using on each visit and I have some code that allows me to affect the back office roles only if he comes from network A.
But if the user logs in first on network A then on his mobile access the site from network B and logs in he will lose his back office role on A unless he logout/login again.
Is there a way to disable all back office (admin) features on each visit if coming from network B? And not on each login? Aka a solution not involving removing his back office roles so he keep them when on network A.
access callback
of a reasonable number of menu callbacks to do that. Also you need to consider what you define as "back office". For example, is editing a node a back office operation in your setup? What about other entity types? You could reliably set something up inhook_menu_alter()
for anything under /admin, it'd even be quite easy, it's just the rest of the paths you need to consider. The other option of course would be to handle it at web server level, so Drupal never gets involved. Might be harder to execute code in that context thoughuser_access
to first check the network