How to give anonymous users access to only certain nodes?

Question

I am trying to implement the following: Anonymous users are not allowed to view all nodes but only certain nodes.

I am using tac lite (https://www.drupal.org/project/tac_lite) to make this happen.

However, the only way I am currently able to control permissions to view nodes is the following:

not giving anonymous user the role 'View published content' and configuring tac_lite or other content access module to allow access to anonymous user to certain pages => doesn't work, access denied when testing nodes that user should has access to see

giving anonymous user the role 'View published content' => doesn't work, now anonymous users will see all the nodes regardless of settings of any other content access modules

Problem is not related to tac_lite. It also happens with for example node view permissions -module https://www.drupal.org/project/node_view_permissions.

Also, when trying to solve the problem this page caught my eye: https://www.drupal.org/node/270000 It says: "Only users who have 'access content'/'view published content' and not 'administer nodes'/'bypass node access' are eligible for the wild world of node access module control.."

I have understood that access control with Drupal is additive. Thus I should not give the anonynomous user the permission to 'view published content'. Yet, the text from https://www.drupal.org/node/270000 seems to contradict with this approach.

This is what devel node access shows when

• I have set 'view published content' permission off for anonymous user
• I have configured tac lite to show that page to anonymous user
• I visit the page as anonymous user

Answer 1

You can use the Rules module for this.

Here is a prototype of a rule (in Rules export format) to get you going:

{ "rules_limit_access_to_some_urls" : {
    "LABEL" : "Limit access to some URLs",
    "PLUGIN" : "reaction rule",
    "OWNER" : "rules",
    "REQUIRES" : [ "rules" ],
    "ON" : { "init" : [] },
    "IF" : [
      { "user_has_role" : {
          "account" : [ "site:current-user" ],
          "roles" : { "value" : { "1" : "1" } }
        }
      },
      { "OR" : [
          { "data_is" : {
              "data" : [ "site:current-page:path" ],
              "op" : "IN",
              "value" : { "value" : [
                  "some\/path1",
                  "some\/path2"
                ]
              }
            }
          },
          { "text_matches" : {
              "text" : [ "site:current-page:url" ],
              "match" : "node\/\\d+\/something",
              "operation" : "regex"
            }
          }
        ]
      }
    ],
    "DO" : [
      { "redirect" : { "url" : "no_access" } },
      { "drupal_message" : {
          "message" : "Access to the content located at \u0022\u003Cstrong\u003E[site:current-page:path]\u003C\/strong\u003E\u0022 is not allowed for Anonymous users.",
          "type" : "warning"
        }
      }
    ]
  }
}

Adapt the paths in it to fit your own needs, to reflect all the paths that anonymous users should not be able access. And for any access module you have enabled, allow access for anonymous users also (any paths that fit in the Rules Conditions will be blocked by the above rule, while any path that does not fit can be accessed by anonymous users). Obviously, using the "negate" facilities or Rules, you could also rework this prototype rule so that you only specify the paths allowed for anonymous users.

Answer 2

You could use the Group module, which allows for creating arbitrary collections of your content and users on your site, and grant access control permissions on those collections.

For details about the various types of roles used by the Group module, refer to my answer to "What are the various roles supported by the Group module?". With these roles in mind, you could configure access to group content like so:

• Members and Outsiders have access to all nodes.
• Anonymous users do not have access to any nodes.

With this configuration, for any node that belongs to a group the Group module will block access for anonyous user (of course). But for those "certain nodes" (as in your question) that you do want anonymous users to be able to access them, just do not assign these nodes to a group (so that the Group access rules don't apply at all).

Resources:

• Community documentation for the Group module.
• Video tutorial "How to use the Group module in Drupal 8 to manage editorial access control to different areas of a web site".