Answers.Body: <p>I'm working on this with @zoog and can confirm that the autocomplete only works when 'CiviCRM Backend and API' permission is granted to anonymous. 
  However changing it to an ordinary select works without this permission.
  Seems independent of 'access AJAX API' which remains granted.
  What do you think @petednz-fuzion - have you got autocomplete work for anonymous?</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-06-04T16:17:00.310Z
Answers.Text: Any news about this?
Answers.UserDisplayName: Johan
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-05-07T05:18:50.273Z
Answers.LastActivityDate: 2019-05-07T05:18:50.273Z
Answers.UserDisplayName: MickC
Body: <p>Versions:</p>
  
  <ul>
  <li>Drupal 7.63</li>
  <li>CiviCRM 5.9.1</li>
  </ul>
  
  <h2>Custom Fields:</h2>
  
  <ul>
  <li><p>Created custom fields with Field Type of Autocomplete-Select with lookup for following fields:</p>
  
  <ul>
  <li>Institution</li>
  <li>Area of Study</li>
  <li>Year of Graduation</li>
  </ul></li>
  <li><p>Used for: Participants (Role): Attendee</p>
  
  <blockquote>
    <p>Attendee is a type of participant for an event type, alongside other types</p>
  </blockquote>
  
  <ul>
  <li>Custom Data Set is active</li>
  <li>Custom Data Set is public</li>
  </ul></li>
  </ul>
  
  <p>Custom fields are to be used by CiviEvent attendees to self select as part of event registration, this information is saved against their contact entry.</p>
  
  <h2>Drupal Permissions</h2>
  
  <ul>
  <li>"CiviCRM: access all custom data" is active for Anonymous User role</li>
  </ul>
  
  <h2>Problem</h2>
  
  <p>When typing in a valid value for the custom field, such as "Accounting" for "Area of Study" the following error of "Loading Failed" is displayed for an unauthenticated user.</p>
  
  <p><a href="https://i.sstatic.net/NrJfo.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/NrJfo.png" alt="Error Message shown to Unauthenticated user"></a></p>
  
  <p>This lookup works fine with the following Drupal Role Permission assigned:</p>
  
  <ul>
  <li>CiviCRM: access CiviCRM backend and API
  
  <ul>
  <li>Master control for access to the main CiviCRM backend and API. Give to trusted roles only.</li>
  </ul></li>
  </ul>
  
  <p>I've been unable to find more information about the security implications of this setting, and the wording of this setting concerns me when thinking to giving it to Anonymous Users.</p>
  
  <p>I'm trying to get the balance of functionality without leaving the system too open, but I'm unsure why I need to expose access to the backend and API to get this working.</p>
  
  <p>When the following Drupal permission is modified: (thanks @petednz)</p>
  
  <ul>
  <li><p>"CiviCRM: access AJAX API" is active</p>
  
  <ul>
  <li>The error message in a cell such as "Area of Study" upon searching an area such as "Accounting" is "None Found" (error has light great background instead of red background per image above)</li>
  </ul></li>
  <li><p>"CiviCRM: access AJAX API" is inactive</p>
  
  <ul>
  <li>The error message in a cell such as "Area of Study" upon searching an area such as "Accounting" is "Loading Failed" (error has red background per screenshot above)</li>
  </ul></li>
  </ul>
  
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2019-01-31T19:28:11.250Z
Comments.Text: Do they have "CiviCRM: access AJAX API" permission?
Comments.UserDisplayName: petednz - fuzion
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2019-02-03T17:53:06.467Z
Comments.Text: Thanks @petednz-fuzion, updated OP to answer your question
Comments.UserDisplayName: zoog
Tags: <civievent><custom-fields><permissions>
Title: Can't access custom fields used in event registration
ThreadText: # Can't access custom fields used in event registration
  
  (Asked by: username_0 on 2019-01-30)
  
  Versions:
  
  * Drupal 7.63
  * CiviCRM 5.9.1
  
  ## Custom Fields:
  
  * Created custom fields with Field Type of Autocomplete-Select with lookup for following fields:
  
    + Institution
    + Area of Study
    + Year of Graduation
  * Used for: Participants (Role): Attendee
  
    > Attendee is a type of participant for an event type, alongside other types
  
    + Custom Data Set is active
    + Custom Data Set is public
  
  Custom fields are to be used by CiviEvent attendees to self select as part of event registration, this information is saved against their contact entry.
  
  ## Drupal Permissions
  
  * "CiviCRM: access all custom data" is active for Anonymous User role
  
  ## Problem
  
  When typing in a valid value for the custom field, such as "Accounting" for "Area of Study" the following error of "Loading Failed" is displayed for an unauthenticated user.
  
  [![Error Message shown to Unauthenticated user](https://i.sstatic.net/NrJfo.png)](https://i.sstatic.net/NrJfo.png)
  
  This lookup works fine with the following Drupal Role Permission assigned:
  
  * CiviCRM: access CiviCRM backend and API
    + Master control for access to the main CiviCRM backend and API. Give to trusted roles only.
  
  I've been unable to find more information about the security implications of this setting, and the wording of this setting concerns me when thinking to giving it to Anonymous Users.
  
  I'm trying to get the balance of functionality without leaving the system too open, but I'm unsure why I need to expose access to the backend and API to get this working.
  
  When the following Drupal permission is modified: (thanks @username_1)
  
  * "CiviCRM: access AJAX API" is active
  
    + The error message in a cell such as "Area of Study" upon searching an area such as "Accounting" is "None Found" (error has light great background instead of red background per image above)
  * "CiviCRM: access AJAX API" is inactive
  
    + The error message in a cell such as "Area of Study" upon searching an area such as "Accounting" is "Loading Failed" (error has red background per screenshot above)
  
  **Tags:** civievent, custom-fields, permissions
  
  > **Comments:**
  > **username_1**: Do they have "CiviCRM: access AJAX API" permission?  
  > **username_0**: Thanks @username_1, updated OP to answer your question  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_2 on 2019-05-07. Score: 1
  
  I'm working on this with @username_0 and can confirm that the autocomplete only works when 'CiviCRM Backend and API' permission is granted to anonymous.
  However changing it to an ordinary select works without this permission.
  Seems independent of 'access AJAX API' which remains granted.
  What do you think @username_1 - have you got autocomplete work for anonymous?
  
  > **Comments:**
  > **username_3**: Any news about this?  
  
  ---
  
  