I need to restrict access to forums so that only selected users can access an individual forum. (The users should apply for a forum and a moderator should decide if the user should be allowed to participate in that forum or not.)

If users visit the forum listing page for the first time, they should only see all forums listed but they should not be able to see the topics.

I have used Flag module to implement a subscription system.

I have set a flag 'subscribe_forum' that allows users to flag a forum, and another flag 'approve_forum_subscription' that allows an administrator to flag a flagging, which means the subscription of the user is accepted.

What I want to do is to grant that user access only to those forums which he has subscribed to and has been approved by an administrator.

The solution you would suggest doesn't have to use this flag system. I am open to any other suggestions.

I have installed Forum Access module, however it allows me to restrict access based on roles, but I need to have a list of users for each individual forum. The only thing that is useful for my case on this module is the ability to set a moderator for individual forums.

Edit: I am also using Advanced Forum module to extend the functionality of the core Forum.


I have mostly achieved my goal using Panel pages which are already provided by Advanced Forum, adding some custom selection rules.

I have added a PHP Code rule which returns TRUE if the user has flagged the forum, and a moderator accepted it (i.e. flagged the flagging of the user), and FALSE otherwise. I have also added a fallback variant which shows only an 'access denied' message in a panel pane.

I have done the same thing to the topic listing panel, as well.

Then, I have enabled the panel page that overrides node/node% and added 2 selection rules, one for checking if the content type is forum and the other one is the custom PHP.

So, I have almost what I wanted to have, but I am not yet completely sure if this method I follow is a good one. To be honest, I don't find it elegant enough.

I am still open to other suggestions. It can also be a completely different approach.

Thanks in advance.

  • 3
    Since your requirement is very much aligned with Organic Groups, have you considered using OG to build a forum-like site rather than using a regular forum? Commented Jun 3, 2013 at 15:13
  • I am already using OG in this site to build some groups. But we need also a forum solution like I described, which should be moderated independent of those OG Groups. I am also using Advanced Forum module to expend the core Forum functionality. Would it be possible to create a new group type that integrates with core or Advanced Forum so that I can restrict the access to each forum to the members of this new group type?
    – Elin Y.
    Commented Jun 3, 2013 at 15:35
  • 1
    It's probably possible but I think it will require some development effort. Last time I checked OG and Forum weren't integrated. Commented Jun 3, 2013 at 15:45
  • I am going to give a try to OG Forum D7 latest dev version.
    – Elin Y.
    Commented Jun 3, 2013 at 15:52
  • I have tried it with OG Forum D7, but I couldn't create a second group type to assign it for forum users. I get an error about a database table already exists, which I guess related to OG 7.x-2.x rather than with OG Forum D7. Nevertheless, I couldn't get it work with this approach. Apart from that, the OG Forum D7 is also not very stable yet.
    – Elin Y.
    Commented Jun 6, 2013 at 10:32

3 Answers 3


If you use views or panels to display the forum, you can use their access controls which are quite flexible. Doesn't look like AF has built views for everything, so I think the easiest way would be to use Panels.

Create a page and under the page settings you have access rules that can be quite elaborate within the UI. You can use a naked layout and then just had the forum entities as content to display and render the full node.

Second Look: Take a look at the Drupal Module Flexiaccess. It looks like exactly what is needed and has a nice UI to manage the users that have access to the individual forum with out writing/maintaining custom stuff:

The Flexi Access module will provide a simple and flexible interface to the ACL (Access Control List) module. It will let you set up and mange ACLs naming individual users that are allowed access to a particular node.

The module let you manage access to individual nodes. The administrator may grant individual users the right to: View (read), update (edit/write), and delete the node.

The main idea behind Flexi Access is to allow flexible per user access control for nodes without the complexity (or features) of Organic Lists, and without having to create a lot of (overlapping) roles.

I see you using Flag to set up the "subscription request" then a moderator looks at the flagged users with the Flag and if approves add em to the ACL with flexiaccess?

  • Hi Tom, thank you for your advice, I was also going with Panels which has integrated access rules, and I am writing some custom PHP to check if the user has flagged the forum and if the flagging is accepted by a moderator. I'll let you know about the success, if I could get it how I want it to be.
    – Elin Y.
    Commented Jun 6, 2013 at 9:10
  • Thanks. How are you moderating the flag? A user flag puts it in the moderate queue and a second moderate flag for the forum access? Depending on the who you moderate, I bet there is an elegant way to do the access with in configuration rather than the custom code.
    – Tom
    Commented Jun 6, 2013 at 15:08
  • I have updated my post. I have 2 type of flags, one for flagging forums, and one for flagging the flaggings. Every user can flag a forum, but only administrators can flag the flaggings. I have made a view for administrators that lists all users which have flagged a forum. In this view, they can also flag this flaggings as approved.
    – Elin Y.
    Commented Jun 6, 2013 at 20:22
  • I couldn't find in the interface any other way to check if the user has flagged the forum and it is accepted by an administrator. That's why I wrote a custom PHP to check the flaggings using Flag 3 API.
    – Elin Y.
    Commented Jun 6, 2013 at 20:23
  • I havent done this before, but it looked like the double flag would be required. Thanks for the update on your strategy.
    – Tom
    Commented Jun 7, 2013 at 7:13

Maybe this is more reliable and worth trying:

  • Create a user list in views with the subscribed users for every forum. In this view you should use the nid of the forum type as a contextual filter.

  • Install and enable Rules Bonus Pack and Conditional Rules modules.

  • Create a rule that will trigger on the event: "When a page variant is loaded" where the page variant = the forum page

  • In that rule set an action "Load a user list with views" to load the above view

  • Add a loop through that list

  • Inside this loop add a conditional and then an Add if condition: uid of current user is not in that list (Data/List contains item/Negate)

  • Finally continue (inside the same loop) by adding an action to redirect the user to some other page and if you want, add another action for the system to send a message like: "Your subscription has not yet been approved by the admin" or something.

I understand the answer is a bit brief. In case you need more details or some help with the rule let me know.


Since you want the most granular form of permission ( per-user), without too much of investigation, I would check:


Second way (non-entirely Drupal, but working) Or writing a custom module that does this functionality.(Gets list of users and a simple field 1 or 0, then in hook node preprocess (php) , you can add some simple logic, to show specific thing only if the value is 1. Also, that will involve some CRUD operations.

There might be other answers though.


  • Thank you for your answer. I have looked at the User Permissions module, but as far as I see it doesn't have any rules integration or something else so that I can imply it some logic. I could write a custom module as well, but I wish I knew the logic I should follow..
    – Elin Y.
    Commented Jun 3, 2013 at 12:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.