I need customers to be able to access certain documents (PDFs mainly) specifically for them (they contain sensitive information). The document information is setup in nodes. I have looked at a lot of access control modules, but they all seem to focus on user roles. I don't want a role for every customer. What would be the best way to structure this?

  • 1
    Sounds like a job for the Groups module + private file/media setup.
    – Kevin
    Commented Jul 30, 2018 at 16:12
  • Again, it seems like you have to set up 1 group for every customer. We have a lot of customers and this seems like a lot of extra overhead. All the documents are individualized, although customers could have 5-10 documents.
    – N Nason
    Commented Jul 30, 2018 at 16:51

1 Answer 1


A possible (but somewhat convoluted) solution could be to use Node access user reference module with private files setup. Basically adding a user reference to a node will allow them to see its content (including files) and having files' folder protected will prevent direct access to the file urls.

  • This looks like a possibility, I'll check into it. What do you mean by "somewhat convoluted"?
    – N Nason
    Commented Jul 31, 2018 at 14:48
  • well I've personally never done anything like it as we tend to write custom code for things like this. Usually only relying on a contrib module gets you only 90-95% of a solution to a fairly complex problem. So just make sure to test all the edge cases (especially if security is important) to make sure everything is in order.
    – kombogdan
    Commented Jul 31, 2018 at 15:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.