I am planning out a Drupal website, and it will have a password protected section. All users will need a username and password to access content, but client wants to issue passwords by company (group). For example, ABC company might have 20 employees, and they can all use the "ABC" username and password (issued by client) to access and read articles/content online. DEF company will use the "DEF" username and password, to access the same content. What is the best module to accomplish this?

2 Answers 2


Introducing password protection to parts of a Drupal website means that you enter the the wild (and somewhat mysterious) world of node access control.

Out of the box, Drupal 7 (and previous versions) only provides a single global permission to grant a role the right to view a node (i.e. view published content in Drupal 7). To get more fine grained access control to published content, you must use a node access module. There are several node access modules to choose from. This page gives a good introduction to the rules that govern node access, and lists the major modules that help you manage node access, along with capsule reviews of each.

There are no single "best" module. Each module have different characteristics. I suggest you identify those you think are the best fit for your site, and check them out, before committing to one of them.

Your plan (to have a company user with a company password) have some logistical problems (see last paragraph), but can be implemented (sort-off) by means of a role based access module.

A better approach (IMHO) would be to create a set of node access "groups" (this can be roles, OG groups, or ACLs - depending upon the module you choose to use), where each "group" consists of all the users associated with a single company. I.e. you assign existing users to these groups. Now users can authenticate with their primary password, but you can set up node access grants to be determined by each user's "group" membership.

The approach you suggest (with a company user and company based password) will have the problem that the company user's password can not be protected against changes without a custom module. Also, you may run into problems if a user leaves one company and joins another. Then the old company's passwords must be changed so that this user may no longer have access, and the new password must be communicated to all existing employees of that company. If you do this the way I suggest, you just remove this user from the group belonging to the old company, and adds him to the group belonging to the new,. That is all that is needed to make sure that he loses access to the content belonging to his "old" company, and gains access to the content belonging to the "new" company.


Organic Groups is probably your best bet.

Enable users to create and manage their own 'groups'. Each group can have subscribers, and maintains a group home page where subscribers communicate amongst themselves.

They do so by posting the usual node types: blog, story, page, etc. A block is shown on the group home page which facilitates these posts. The block also provides summary information about the group.

Groups may be selective or not. Selective groups require approval in order to become a member, or even invitation -only groups. There are lots of preferences to configure groups as you need.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.