I am considering Drupal for a project with following features:

  • I need two content types: Supplier and Client.
  • I want my clients to be able to follow the progress of their orders (each order will be a node).
  • My suppliers will have access to their invoices, documents, etc. (which are nodes as well)

Any ideas on how to achieve this?


  • Client Alpha will have access to node/34 and node/46 only.
  • Supplier Beta will have access to node/38 and node/50 and their attached files only.
  • And so on ...

Is this possible with Drupal (6, 7) ? If so how can I do this, do I need custom coding or are there any other solutions for it?

2 Answers 2


Depending on how much more deep you want to take the logic of your project, you might not even need custom coding.

  1. Start with Drupal 7 minimal installation profile

  2. Install the modules views, entity, entity reference and their dependencies.

  3. Create the content type "order" and add the fields you need to it. Add other content types as well like "invoice" and document, these last you might want to add a "reference" field to the order content type if they are connected.

  4. Setup the user roles "client" and "supplier" and you might want to install the "ACL" and "content access" modules as well to define who has access to what, like "only"3 the author of the node can see it, edit it and delete it.

  5. To make it easier for the user to see the nodes they have access to, you can create a tab on their user account using views listing only the node where they have access or where they are the authors.

Notes: You might want to test the system before going live to make sure the right person can access the right content. Also if no anonymous user is meant to use the system disable content access to the anonymous users.


Seems like what you're trying to do is perfectly possible using the Content Access module. Here is a quote from its project page:

This module allows you to manage permissions for content types by role and author. It allows you to specify custom view, edit and delete permissions for each content type. Optionally you can enable per content access settings, so you can customize the access for each content node.

After you've enabled this module, you would typically configure which access rules you want to be applied automatically for your Suppliers, and similarly for your Clients. For that you could define 2 roles, named (eg) Supplier and Client. Once you have those roles in place, you simply start granting the appropriate access to your content types of Orders, Invoices and Documents, which IMO should be 3 separate content types also.

It also appears that, for your case, and for each of these content types, you'd want to use the special facility that this module offers, which is "* Per content node access control settings*". Some more details about this (from the admin page that contains this setting):

Optionally you can enable per content node access control settings. If enabled, a new tab for the content access settings appears when viewing content. You have to configure permission to access these settings at the permissions page.

For anything that has the same access permissions (eg read access to "Terms & Conditions"), you may not have to use the above Per content node access control settings (which take time to maintain for each node ...). E.g. if you'd use another content type the same access rule could apply to all such nodes.

Rebuild permissions

Sometimes you'll need to "Rebuild permissions" ... Any time the "Access" rules are changed (via admin settings), Drupal needs to ensure that these rules are applied to all impacted content (nodes). That's why Drupal then re-applies the updated access rules. A special case is the "enable" of a module, when rebuilding permissions is also required.

Integrations with other modules

Content Access also has all sorts of integrations with the Rules module, which you may use to make all sort of custom business logic happen (only using the Admin UI, no custom code needed, unless you insist ...). For a typical example of this, refer to my answer to "How to revoke edit access to the node's author after publishing a node?".

On top of that, if you want to start using the Content Access module for an existing sites (where you need to mass grant the appropriate permissions), you can use an approach as explained in my answer to "How to create a bulk grant view form for the node access module?".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.