Answers.Body: <p>I had a scenario similar to yours, and I have found the solution in CMS permissions using the related permission extension.
  CMS permissions are above ACLs rules. So before to create ACLs rules, check your CMS permissions and verify that you don't allow your &quot;Admin club&quot; to see all contacts. In our case, we define that &quot;Admin club&quot; cannot view AND edit all contacts, and in ACLs, we define &quot;Admin club&quot; can only see his club contact through the related permission.</p>
  <p>It took us a few time to understand that it's an option in the dropdown select menu for 'Custom Fields' (here, 'Données personnalisées'). .</p>
  <p><a href="https://i.sstatic.net/lkgoR.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/lkgoR.png" alt="enter image description here" /></a></p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2021-12-10T13:36:10.183Z
Answers.LastActivityDate: 2021-12-13T19:25:55.983Z
Answers.LastEditDate: 2021-12-13T19:25:55.983Z
Answers.UserDisplayName: Anass
Answers.Body: <blockquote>
  <p>I am trying to create a login controlled by an ACL that limits a Club Admin to viewing, editing and creating only their own members.</p>
  </blockquote>
  <p>The <a href="https://github.com/eileenmcnaughton/nz.co.fuzion.relatedpermissions" rel="nofollow noreferrer">Permissioned Relationship</a> extension makes an ACL based around the relationship and could provide what you need. We use it in many scenarios similar to yours</p>
  <p>One <a href="https://fuzion.co.nz/relationship-permissions-acls" rel="nofollow noreferrer">write up</a> about it is here</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2021-08-03T02:28:28.087Z
Answers.Text: petednz, thanks. I am hoping there's a solution that doesn't require having to add the contacts to groups or relationships as extra steps on top of adding them to a membership.
Answers.UserDisplayName: Scarlett
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2021-08-03T02:33:44.693Z
Answers.Text: "Each club can have hundreds of their own members and club members inherit a membership to the Federation through their Club" - i assumed you already had relationships working - and if you do then this should not require any additional ongoing work, other than also added a Club Admin to Club relationship, which could be a Caldera form so it could potentially be self-managed i think
Answers.UserDisplayName: petednz - fuzion
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2021-08-02T20:06:31.237Z
Answers.LastActivityDate: 2021-08-02T20:06:31.237Z
Answers.UserDisplayName: petednz - fuzion
Body: <p>It seems using ACLs to limit access to contacts is a hot topic. I've reviewed many of the questions on the topic, many years old, but have yet to find a solution. Scenario is:</p>
  <p>• Our Federation has direct members (paid) and 52 member clubs (free).</p>
  <p>• Each club can have hundreds of their own members and club members inherit a
  membership to the Federation through their Club.</p>
  <p>• I am trying to create a login controlled by an ACL that limits a Club Admin to
  viewing, editing and creating only their own members.</p>
  <p>• Clubs in Wordpress are assigned the Club Admin User Role with permissions for
  CiviCRM.</p>
  <p>• I've put the Club contact type 'Organization-Member Club' into a group 'Clubs'</p>
  <p>• I've created a Club Admin Role assigned to the group Clubs.</p>
  <p>• I'm creating an ACL for each specific club using the Club Admin Role, allowing 'Edit' on 'group of contacts' data assigned to the specific club group</p>
  <p>• Tried creating a 'Smart Group' on search for specific club Membership which finds the memberships but doesn't allow Access Control, only Mailing List.</p>
  <p>The only results I can get when logged in as a Club Admin user is a listing of all Contacts, if I have 'view all contacts' in the WP permissions — if I don't have that permission, I get nothing. I've been through many, many combinations of permissions, roles, groups, relationships, memberships and ACL settings. Is there not a solution that doesn't require creating multiple entries in separate tabs? This seems like a pretty common requirement for multi-level organizations, what am I missing?</p>
  
Tags: <wordpress><acl>
Title: ACL to limit access to contacts by Membership
ThreadText: # ACL to limit access to contacts by Membership
  
  (Asked by: username_0 on 2021-08-02)
  
  It seems using ACLs to limit access to contacts is a hot topic. I've reviewed many of the questions on the topic, many years old, but have yet to find a solution. Scenario is:
  
  • Our Federation has direct members (paid) and 52 member clubs (free).
  
  • Each club can have hundreds of their own members and club members inherit a
  membership to the Federation through their Club.
  
  • I am trying to create a login controlled by an ACL that limits a Club Admin to
  viewing, editing and creating only their own members.
  
  • Clubs in Wordpress are assigned the Club Admin User Role with permissions for
  CiviCRM.
  
  • I've put the Club contact type 'Organization-Member Club' into a group 'Clubs'
  
  • I've created a Club Admin Role assigned to the group Clubs.
  
  • I'm creating an ACL for each specific club using the Club Admin Role, allowing 'Edit' on 'group of contacts' data assigned to the specific club group
  
  • Tried creating a 'Smart Group' on search for specific club Membership which finds the memberships but doesn't allow Access Control, only Mailing List.
  
  The only results I can get when logged in as a Club Admin user is a listing of all Contacts, if I have 'view all contacts' in the WP permissions — if I don't have that permission, I get nothing. I've been through many, many combinations of permissions, roles, groups, relationships, memberships and ACL settings. Is there not a solution that doesn't require creating multiple entries in separate tabs? This seems like a pretty common requirement for multi-level organizations, what am I missing?
  
  **Tags:** wordpress, acl
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_1 on 2021-12-10. Score: 1
  
  I had a scenario similar to yours, and I have found the solution in CMS permissions using the related permission extension.
  CMS permissions are above ACLs rules. So before to create ACLs rules, check your CMS permissions and verify that you don't allow your "Admin club" to see all contacts. In our case, we define that "Admin club" cannot view AND edit all contacts, and in ACLs, we define "Admin club" can only see his club contact through the related permission.
  
  It took us a few time to understand that it's an option in the dropdown select menu for 'Custom Fields' (here, 'Données personnalisées'). .
  
  [![enter image description here](https://i.sstatic.net/lkgoR.png)](https://i.sstatic.net/lkgoR.png)
  
  
  ---
  
  ### Answer by username_2 on 2021-08-02. Score: 0
  
  > I am trying to create a login controlled by an ACL that limits a Club Admin to viewing, editing and creating only their own members.
  
  The [Permissioned Relationship](https://github.com/eileenmcnaughton/nz.co.fuzion.relatedpermissions) extension makes an ACL based around the relationship and could provide what you need. We use it in many scenarios similar to yours
  
  One [write up](https://fuzion.co.nz/relationship-permissions-acls) about it is here
  
  > **Comments:**
  > **username_0**: petednz, thanks. I am hoping there's a solution that doesn't require having to add the contacts to groups or relationships as extra steps on top of adding them to a membership.  
  > **username_2**: "Each club can have hundreds of their own members and club members inherit a membership to the Federation through their Club" - i assumed you already had relationships working - and if you do then this should not require any additional ongoing work, other than also added a Club Admin to Club relationship, which could be a Caldera form so it could potentially be self-managed i think  
  
  ---
  
  