Answers.Body: <p>Craig - I can't comment on why you might have conflicting ACLs, but want to mention the <a href="https://civicrm.org/extensions/relationship-permissions-acls" rel="nofollow">Permissioned Relationships as ACLs</a> which we built and contributed to provide another solution for multi-level permissioning. You can read about it via the link, but it may suit your need and deals easily with the situation of Staff Member Q needing to access the contacts in two regions, but giving Q a relationship with Region A and Region B, and therefore seeing all those contacts that the Region A and B have permission to access.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-03-09T17:11:18.450Z
Answers.Text: Hi Pete,
  
  Yeah, I'd thought of configuring households to be projects, but guess it would work as well if they were an organisation sub-type.
  
  I looked at this last year but with the amount of custom data to reconfigure I think the site would need to come off line for a week to rebuild everything. And the client didn't want down time.
  
  May have to bite the bullet on that in some way though.
Answers.UserDisplayName: Craig Almond
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-03-08T18:39:08.467Z
Answers.LastActivityDate: 2016-03-08T18:39:08.467Z
Answers.UserDisplayName: petednz - fuzion
Body: <p>We manage a site for a charity working with victims of domestic violence.</p>
  
  <p>They work in 5 separate locations , and the organisation's preference is for staff working in a given area only to be able to access contact records (for staff and clients) in that area.</p>
  
  <p>(In the past they have had to deal with relatives of offenders who have become staff members in different locations in order to access victim's details from their system).</p>
  
  <p>Initially they worked across 3 locations and ACL's worked fine. As there work expanded and more projects came on line, the number of ACL roles and number of extra groups to give access to has expanded. Additionally some staff work across more than one project/ ACL role.</p>
  
  <p>Intermittently the ACL rules fail, and staff members can see fewer contacts within a group than are in it. ie. Location Contact group has 729 members, when Staff Member A views that group from a find contacts search she see's 149 contacts.</p>
  
  <p>(I've checked this using the Drupal Masquerade module). </p>
  
  <p>It seems to me that multiple ACL roles are conflicting with one another, and restricting the number of contacts the staff member can view.</p>
  
  <p>I've fixed this in the past, by deleting ACLs and rebuilding from scratch. Eventually this falls over and we need to do that again.</p>
  
  <p>Has anyone experienced anything like this? </p>
  
  <p>Any ideas what may be causing this intermittent problem?</p>
  
  <p>Drupal 7.39 Civi 4.4.21</p>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2016-03-09T19:31:43.510Z
Comments.Text: Have you seen this? https://issues.civicrm.org/jira/browse/CRM-18127. was just talking with a client about how their ACL were not working, and then suddently they started again while he was testing. Have you tried clearing caches?
Comments.UserDisplayName: petednz - fuzion
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2016-03-10T16:18:11.503Z
Comments.Text: No, I hadn't seen it. It's not quite the same. If I search for a group in Find Contacts, as admin, I see 1-1059 group members. If I search masquerading as Staff Member I see 1-149 group members, but can access all that I see. 
  
  And, yes we've tried clearing cache.
Comments.UserDisplayName: Craig Almond
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2016-03-10T20:44:18.077Z
Comments.Text: wonders aloud if this has any similarity with other situations we have seen where Smart Groups have become malformed (broken) which can cause the group cache build to be interupted
Comments.UserDisplayName: petednz - fuzion
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2016-03-11T11:41:26.317Z
Comments.Text: As in staff member adds client to smart group?
Comments.UserDisplayName: Craig Almond
Tags: <contacts><acl>
Title: Possible reasons for ACLs to fail
ThreadText: # Possible reasons for ACLs to fail
  
  (Asked by: username_0 on 2016-03-08)
  
  We manage a site for a charity working with victims of domestic violence.
  
  They work in 5 separate locations , and the organisation's preference is for staff working in a given area only to be able to access contact records (for staff and clients) in that area.
  
  (In the past they have had to deal with relatives of offenders who have become staff members in different locations in order to access victim's details from their system).
  
  Initially they worked across 3 locations and ACL's worked fine. As there work expanded and more projects came on line, the number of ACL roles and number of extra groups to give access to has expanded. Additionally some staff work across more than one project/ ACL role.
  
  Intermittently the ACL rules fail, and staff members can see fewer contacts within a group than are in it. ie. Location Contact group has 729 members, when Staff Member A views that group from a find contacts search she see's 149 contacts.
  
  (I've checked this using the Drupal Masquerade module).
  
  It seems to me that multiple ACL roles are conflicting with one another, and restricting the number of contacts the staff member can view.
  
  I've fixed this in the past, by deleting ACLs and rebuilding from scratch. Eventually this falls over and we need to do that again.
  
  Has anyone experienced anything like this?
  
  Any ideas what may be causing this intermittent problem?
  
  Drupal 7.39 Civi 4.4.21
  
  **Tags:** contacts, acl
  
  > **Comments:**
  > **username_1**: Have you seen this? https://issues.civicrm.org/jira/browse/CRM-18127. was just talking with a client about how their ACL were not working, and then suddently they started again while he was testing. Have you tried clearing caches?  
  > **username_0**: No, I hadn't seen it. It's not quite the same. If I search for a group in Find Contacts, as admin, I see 1-1059 group members. If I search masquerading as Staff Member I see 1-149 group members, but can access all that I see.   And, yes we've tried clearing cache.  
  > **username_1**: wonders aloud if this has any similarity with other situations we have seen where Smart Groups have become malformed (broken) which can cause the group cache build to be interupted  
  > **username_0**: As in staff member adds client to smart group?  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2016-03-08. Score: 1
  
  username_0 - I can't comment on why you might have conflicting ACLs, but want to mention the [Permissioned Relationships as ACLs](https://civicrm.org/extensions/relationship-permissions-acls) which we built and contributed to provide another solution for multi-level permissioning. You can read about it via the link, but it may suit your need and deals easily with the situation of Staff Member Q needing to access the contacts in two regions, but giving Q a relationship with Region A and Region B, and therefore seeing all those contacts that the Region A and B have permission to access.
  
  > **Comments:**
  > **username_0**: Hi Pete,  Yeah, I'd thought of configuring households to be projects, but guess it would work as well if they were an organisation sub-type.  I looked at this last year but with the amount of custom data to reconfigure I think the site would need to come off line for a week to rebuild everything. And the client didn't want down time.  May have to bite the bullet on that in some way though.  
  
  ---
  
  