I am trying to implement the following: Anonymous users are not allowed to view all nodes but only certain nodes.

I am using tac lite (https://www.drupal.org/project/tac_lite) to make this happen.

However, the only way I am currently able to control permissions to view nodes is the following:

not giving anonymous user the role 'View published content' and configuring tac_lite or other content access module to allow access to anonymous user to certain pages => doesn't work, access denied when testing nodes that user should has access to see

giving anonymous user the role 'View published content' => doesn't work, now anonymous users will see all the nodes regardless of settings of any other content access modules

Problem is not related to tac_lite. It also happens with for example node view permissions -module https://www.drupal.org/project/node_view_permissions.

Also, when trying to solve the problem this page caught my eye: https://www.drupal.org/node/270000 It says: "Only users who have 'access content'/'view published content' and not 'administer nodes'/'bypass node access' are eligible for the wild world of node access module control.."

I have understood that access control with Drupal is additive. Thus I should not give the anonynomous user the permission to 'view published content'. Yet, the text from https://www.drupal.org/node/270000 seems to contradict with this approach.

This is what devel node access shows when

  • I have set 'view published content' permission off for anonymous user
  • I have configured tac lite to show that page to anonymous user
  • I visit the page as anonymous user

devel node access debug info

  • Have you rebuilt the node access permissions? If you've made any changes then they will need rebuilt. – Colin Shipton Dec 19 '16 at 16:47
  • So that debug message is saying that both tac_lite and domain are allowing access to view the node. So, it looks like your tac_lite config is incorrect (or as noted above, you need to rebuild node access, check the status report). It also looks like the domain module may be conflicting with tac_lite, since it is granting view access. BTW, you can read more about how this all works at api.drupal.org/api/drupal/modules%21node%21node.module/group/… That block is showing the grants. – mpdonadio Dec 20 '16 at 1:26

You can use the Rules module for this.

Here is a prototype of a rule (in Rules export format) to get you going:

{ "rules_limit_access_to_some_urls" : {
    "LABEL" : "Limit access to some URLs",
    "PLUGIN" : "reaction rule",
    "OWNER" : "rules",
    "REQUIRES" : [ "rules" ],
    "ON" : { "init" : [] },
    "IF" : [
      { "user_has_role" : {
          "account" : [ "site:current-user" ],
          "roles" : { "value" : { "1" : "1" } }
      { "OR" : [
          { "data_is" : {
              "data" : [ "site:current-page:path" ],
              "op" : "IN",
              "value" : { "value" : [
          { "text_matches" : {
              "text" : [ "site:current-page:url" ],
              "match" : "node\/\\d+\/something",
              "operation" : "regex"
    "DO" : [
      { "redirect" : { "url" : "no_access" } },
      { "drupal_message" : {
          "message" : "Access to the content located at \u0022\u003Cstrong\u003E[site:current-page:path]\u003C\/strong\u003E\u0022 is not allowed for Anonymous users.",
          "type" : "warning"

Adapt the paths in it to fit your own needs, to reflect all the paths that anonymous users should not be able access. And for any access module you have enabled, allow access for anonymous users also (any paths that fit in the Rules Conditions will be blocked by the above rule, while any path that does not fit can be accessed by anonymous users). Obviously, using the "negate" facilities or Rules, you could also rework this prototype rule so that you only specify the paths allowed for anonymous users.

  • Pretty sure I know the answer to this, but this will only prevent access to the node pages, and not other places where nodes are used and rely on the node access system? – mpdonadio Dec 20 '16 at 1:20

You could use the Group module, which allows for creating arbitrary collections of your content and users on your site, and grant access control permissions on those collections.

For details about the various types of roles used by the Group module, refer to my answer to "What are the various roles supported by the Group module?". With these roles in mind, you could configure access to group content like so:

  • Members and Outsiders have access to all nodes.
  • Anonymous users do not have access to any nodes.

With this configuration, for any node that belongs to a group the Group module will block access for anonyous user (of course). But for those "certain nodes" (as in your question) that you do want anonymous users to be able to access them, just do not assign these nodes to a group (so that the Group access rules don't apply at all).


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.