Here is the scenario:

  • I have 10 roles (plus the 3 core roles, anon, auth, administrator).
  • I have 7 roles imported from an outside system.
  • Users can belong to multiple roles.
  • Editors need to be able to check off in a list of these roles when editing content, as to whom can view the content.
  • If none are selected, anyone can view.
  • A user only needs to possess one of the roles checked off in order to have access.

There does not seem to be a solid solution for Drupal 8 out there. Content Access is unfinished, Permissions by Term is too restrictive, and Access by Entity currently does not work.

What is the path of least resistance to enabling view based access if the options are enabled? Where can I start?

1 Answer 1


To further complete the list of content access modules you mentioned, i.e.:

There does not seem to be a solid solution for Drupal 8 out there. Content Access is unfinished, Permissions by Term is too restrictive, and Access by Entity currently does not work.

I recommend you have a look at the Group module, which allows for creating arbitrary collections of your content and users on your site, and grant access control permissions on those collections.

Group creates groups as entities, making them fully fieldable, extensible and exportable. Every group can have users, roles and permissions attached to it. Groups can also act as a parent of any type of entity. Group provides an extensive API to attach entities to groups.

Sample configuration

Below is an example of a possible configuration, which may help to get you started with possible configurations (using the Group module):

Group type ID ! Group type ! Group role ID ! Role
 1            ! Class      ! 3             ! Instructor
 1            ! Class      ! 4             ! Student
 2            ! Customers  ! 5             ! Lead
 2            ! Customers  ! 6             ! Prospect
 2            ! Customers  ! 7             ! Licensed Customer
 2            ! Customers  ! 8             ! Sales
 2            ! Customers  ! 9             ! Support
 2            ! Customers  ! 10            ! Accounting
 2            ! Customers  ! 11            ! R&D
 3            ! Project    ! 12            ! Project Manager
 3            ! Project    ! 13            ! Developer
 3            ! Project    ! 14            ! Customer 

Group Types

The above example consists of 3 group types:

  • Class.
  • Customers.
  • Project.

Group Roles

For each of the 3 group types, there are specific Roles defined, some more details about some of them:

  • for the Class group, these are the 2 roles that are configured:
    • Instructor.
    • Student.
  • for the Project group, these are the 3 roles that are configured:
    • Project Manager.
    • Developer.
    • Customer.

These are the Group Specific Roles: these roles can be configured per group type and will only be available on groups of that group type. As an example, for group type "Class", the defined roles are Instructor and Student (which are not available for the other group types).

On top of the group specific roles, there are also Special Global Roles: These are the special (hardcoded) roles named Outsider (= a signed in user that did not join a group) and Member (= a signed in user that did join a group). These cannot be defined by the Drupal administrator, and they are always available for any group. These roles can have different permissions sets for each group type. Special case: the role Anonymous is related to a user that is not signed.


Each of the configured group types can have any number of Groups.

Examples of groups:

  • for the Class group type, there could be these Groups:
    • Getting started with Drupal.
    • Drupal for site builders.
    • Become an expert in using the Rules module.
  • for the Customers group type, there could be these Groups:
    • Service Requests.
    • Order Processing.
    • Sales Orders.
    • Relationship Management.


For each of the configured group types, you can then also configure for each Content Type which Role has what kind of access (= none, view, create, edit, delete). Be aware: even though this looks similar to Drupal's permission configuration, these permissions are not the same permissions (they are specific to the Group module).

Module integrations

The Group module integrates with various other (popular) modules, such as Views, Rules, etc. These integrations are more or less out-of-the box (not dozens of extra modules needed to make those integrations work). Simply because everything is entity based.


PS: this answer applies to either D7 or D8.

  • How about just saying, these roles can access this page?
    – Kevin
    Jul 17, 2017 at 17:27
  • @Kevin : I don't understand you prior comment, can you clarify? Jul 17, 2017 at 19:10
  • Like I don't need groups of roles, per se, I just want to go to different nodes and say, role X, Y, and Z can view this page. I haven't been able to install it yet, but if it can do that very simply, I will give it a shot.
    – Kevin
    Jul 17, 2017 at 19:10
  • That's what you'd do with a module such as "content access" (in D7). Group uses a different approach though: you indicate to which "group" the node belongs. And then it depends on how you configured access rights within the group module (view access, update access, etc) about which users (actually group roles) will have access. Recommended starting point if you're new to Group = the Video tutorial (within Resources). Jul 17, 2017 at 19:19
  • Content Access in 8 is not finished though - didn't appear to let you set per node access rights even though it says it can.
    – Kevin
    Jul 17, 2017 at 19:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.