I have a hard time figuring out which Drupal module to use for groups. There are quite a lot of options for Drupal 8 that provide useful functionality. So far I have looked (at various points in time) at the following modules:

  • Group
  • Organic Groups
  • Taxonomy combined with Permissions by term
  • Workbench+Workbench Access

The last two are the ones I tried latest. Workbench Access only allows editing access permissions to be regulated, not viewing. While the Permission by term module only allows viewing content, while not really regulating editing (except that when you don't have view access you can't edit either). I can't remember the Organic groups module very precisely anymore, but from what I (subjectively) gather from other posts/docs, the Group module is meant to be a better replacement. And that pushes me too much in a format with their groups pages and stuff.

What I am really looking for is to have roles, where each role represents a department of my organization. On the other hand we have content that I want to be able to assign to a department, but also specify whether that content should be only accessible to department members only (separately for view and edit), or potentially for all authenticated users, or even anonymous users. The access permissions should be different for each individual node, not on a content type basis. And additionally users should only be able to create content for their own department.

I got there almost with permission by term and taxonomy, where the "access level" vocabulary specifies who can access the node (and taxonomy terms that a user doesn't have access to are automatically hidden), while the "department" vocabulary determines which department a node should be listed under. Views and display suite fill in the rest.

But as I said, this doesn't allow me to control edit permissions for nodes, only view permissions. I could potentially combine this with workbench access to organize the edit permissions, but somehow this feels to me like looking for trouble with combining different permission modules.

Does anyone have a recommendation for a setup that allows me to arrange editing and viewing of nodes per "department" and on a per-node basis?

  • @kiamlaluno didn't I describe what I have done so far to solve it and what I specifically am looking for? I need view permissions outside of groups and edit permissions inside the groups. I specify that I have tried workbench access with it's drawbacks and permisisons by term with it's drawbacks and ask specifically what combination of modules would solve those two problems. So I am not just blankly asking for the "best" module. Nov 23, 2017 at 3:43
  • Sure, but you are talking about three different modules, then asking for recommendations, which means the answer should first recommend a module, which is exactly what happened.
    – apaderno
    Nov 23, 2017 at 7:47
  • Hmm, maybe a discussion for drupal.meta.stackexchange.com, but if you are stuck with a problem that you can't solve with the modules you tried and don't know which modules could solve it, you won't ever get any further. Whichever way I would have frased the question, the answer would always be along the lines of "you can't do it with just Permissions by terms and Taxonomy, you need the Group module", even if I didn't ask the "which module" question. Nov 23, 2017 at 9:34
  • As long as the question is not asking (directly or not) for a recommendation, or recommending is the most important part of the answer, the question is fine. You could not understand the difference between two modules of which you see they have similar, if not very close, features, and you want to know which one you should use. In this case, the question should be detailed and not generic as "What are the differences between the Organic Groups module and the Group module?" At least, the OP should show to understand perfectly the topic, and not saying I have heard of these two modules.
    – apaderno
    Nov 23, 2017 at 9:58
  • If you are stuck with a problem, and you don't understand which module you should use, you need to investigate about them yourself. Once you are at the point you can ask a question that is not about recommending one of the modules, you can ask a question. For example, it could be a question like I am trying to achieve this with this module, but when I do this, I obtain a different result. What am I doing wrong? Still, the question needs to be very specific, not vague.
    – apaderno
    Nov 23, 2017 at 10:02

1 Answer 1


You should really give the Group module a try, which allows for creating arbitrary collections of your content and users on your site, and grant access control permissions on those collections.

It creates groups as entities, making them fully fieldable, extensible and exportable. Every group can have users, roles and permissions attached to it (refer to "What are the various roles supported by the Group module?" for more details about that).

Sample configuration

Below is an example of a possible configuration, which may help to get you started with possible configurations (using the Group module):

Group type ID ! Group type ! Group role ID ! Role
 1            ! Class      ! 3             ! Instructor
 1            ! Class      ! 4             ! Student
 1            ! Class      ! 5             ! Alumni
 2            ! Customers  ! 6             ! Lead
 2            ! Customers  ! 7             ! Prospect
 2            ! Customers  ! 8             ! Licensed Customer
 2            ! Customers  ! 9             ! Sales
 2            ! Customers  ! 10            ! Support
 2            ! Customers  ! 11            ! Accounting
 2            ! Customers  ! 12            ! R&D
 3            ! Project    ! 13            ! Project Manager
 3            ! Project    ! 14            ! Developer
 3            ! Project    ! 15            ! Customer 

Group Types

The above example consists of 3 group types:

  • Class.
  • Customers.
  • Project.

Group Roles

For each of the 3 group types, there are specific Roles defined, some more details about some of them:

  • for the Class group, these are the 3 roles that are configured:
    • Instructor.
    • Student.
    • Alumni.
  • for the Project group, these are the 3 roles that are configured:
    • Project Manager.
    • Developer.
    • Customer.

These roles can be configured per Group type and will only be available on groups of that group type. As an example, for group type "Class", the defined roles are Instructor, Student and Alumni (which are not available for the other group types).

On top of the group specific roles, there are also Special Global Roles: These are the special (hardcoded) roles named Outsider (= a signed in user that did not join a group) and Member (= a signed in user that did join a group). These cannot be defined by the Drupal administrator, and they are always available for any group. These roles can have different permissions sets for each group type. Special case: the role Anonymous is related to a user that is not signed.


Each of the configured group types can have any number of Groups.

Examples of groups:

  • for the Class group type, there could be these Groups:
    • Getting started with Drupal.
    • Drupal for site builders.
    • Become an expert in using the Rules module.
  • for the Customers group type, there could be these Groups:
    • Service Requests.
    • Order Processing.
    • Sales Orders.
    • Relationship Management.


For each of the configured group types, you can then also configure for each Content Type which Role has what kind of access (= none, view, create, edit, delete). Be aware: even though this looks similar to Drupal's permission configuration, these permissions are not the same permissions (they are specific to the Group module).

Addressing your specific questions

Here is a possible recipe to get you going:

  • You'd only need 1 group type, say labeled "Departments".

  • Define whatever Group Roles you'd need for this Group Type and configure the desired Group permissions for each of those roles.

  • Creating Groups like Department A, Department B, Etc.

  • Make each user a member of the appropriate group (could be 1 or more, depends on your needs).

  • Assign each node to the appropriate group.

Further refinements using some other modules

Additional permissions per node

Providing additional view permissions for specific nodes to "Outsiders" (not member of a group) can be provided by the Permission by terms module.

This can by achieved by creating a Taxonomy Term reference field on nodes which points to a vocabulary "Additional Permissions" with terms "public" and "intranet users". Those terms get permissions assigned to them for respectively the "Anonymous Users" and "Authenticated Users" roles. When you set the field on a node to either of those values, users of the respective roles get view permissions, irrespective of the group view permissions. Nodes that don't have a value for the term reference field just get the group permissions by default. Edit permissions are not affected by this and are just defined by the group roles/permissions.

Changing the Group page layout

If you don't like the default way the group pages look like, you can modify them by using the page manager, together with panelizer and bootstrap_kit for instance. Together with views (using the "Group content" and "Content from group content" relationships optionally) gives you tremendous flexibility over how the group page is displayed.

Comparison with the Organic groups module

Have a look at my answer to "What are the features of the Group module versus Organic Group module?" for details about:

  • How both modules (Group versus Organic groups) compare to each other.
  • Integration with various modules that you might want to take advantage of also.



Not the answer you're looking for? Browse other questions tagged or ask your own question.