Answers.Body: <p>So it turned out that the &quot;Contact edit&quot; capability was turned on for the &quot;Authenticated User&quot; role.  One needs to remember that Drupal &quot;ORs&quot; the permissions for logged in users in any custom role with the permissions in the &quot;Authenticated User&quot; role.</p>
  <p>Always check the defaults before blaming the software!</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2021-01-18T20:44:47.583Z
Answers.LastActivityDate: 2021-01-18T20:44:47.583Z
Answers.UserDisplayName: MartinH
Body: <p>I'm trying to set up a read-only role in CiviCRM on Drupal.  The environment is Drupal 8.9.12, CiviCRM 5.32.2 on Centos 8 with Apache.  This is a brand new installation I'm setting up for an organization that I volunteer for.  (I'm new to CiviCRM but have a long career with the IT industry and Linux in particular.)  Right now I'm working on a test environment that I've set up for learning my way around.</p>
  <p>I've created a role in Drupal and enabled a number of CiviCRM &quot;view&quot; permissions in this role.  I've then created a used and assigned the newly created role to this user.</p>
  <p>If I log in as this user I get &quot;Access denied&quot; for everything I've tried.  If I now enable &quot;CiviCRM: access CiviCRM backend and API&quot; for this read only role, I can now see the CiviCRM pages but I also seem to ave the ability to edit, which I'm trying to prohibit.</p>
  <p>This is all on a virgin install.  I didn't encounter any problems installing the software, and if I log in as a user with adminitrator permissions everything works as expected, so there doesn't seem to be a problem with the install.</p>
  <p>Any ideas?</p>
  <p>Thanks,
  Martin</p>
  
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2021-01-18T19:08:54.797Z
Comments.Text: For view-only, you might want to think about doing it as drupal views (via https://www.drupal.org/project/civicrm_entity for drupal 8).
Comments.UserDisplayName: Demerit
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2021-01-18T19:50:33.457Z
Comments.Text: Thanks, I'm looking at this but it seems like a lot of work for providing what seems to be already catered for.  I have to wonder if the built in CiviCRM/Drupal roles implementation is buggy...
Comments.UserDisplayName: MartinH
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2021-01-18T20:05:22.113Z
Comments.Text: It's just read-only is an unusual setup for CiviCRM's "backend" screens. You might be able to do it with ACLs. See https://docs.civicrm.org/user/en/latest/initial-set-up/permissions-and-access-control/
Comments.UserDisplayName: Demerit
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2021-01-18T20:29:27.587Z
Comments.Text: OK I figured it out.  The "edit" capability was set for Authenticated Users.  Moral:  always check Authenticated users.  The default settings may not be what you want...
Comments.UserDisplayName: MartinH
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2021-01-18T20:32:31.680Z
Comments.Text: Ok great! You can answer your own questions on stackexchange by filling out the answer field below - it's encouraged even.
Comments.UserDisplayName: Demerit
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2021-01-18T21:41:27.357Z
Comments.Text: @Demerit thanks for the pointers.
Comments.UserDisplayName: MartinH
Tags: <drupal><roles>
Title: Trying to set up read only role in Drupal
ThreadText: # Trying to set up read only role in Drupal
  
  (Asked by: username_0 on 2021-01-18)
  
  I'm trying to set up a read-only role in CiviCRM on Drupal. The environment is Drupal 8.9.12, CiviCRM 5.32.2 on Centos 8 with Apache. This is a brand new installation I'm setting up for an organization that I volunteer for. (I'm new to CiviCRM but have a long career with the IT industry and Linux in particular.) Right now I'm working on a test environment that I've set up for learning my way around.
  
  I've created a role in Drupal and enabled a number of CiviCRM "view" permissions in this role. I've then created a used and assigned the newly created role to this user.
  
  If I log in as this user I get "Access denied" for everything I've tried. If I now enable "CiviCRM: access CiviCRM backend and API" for this read only role, I can now see the CiviCRM pages but I also seem to ave the ability to edit, which I'm trying to prohibit.
  
  This is all on a virgin install. I didn't encounter any problems installing the software, and if I log in as a user with adminitrator permissions everything works as expected, so there doesn't seem to be a problem with the install.
  
  Any ideas?
  
  Thanks,
  Martin
  
  **Tags:** drupal, roles
  
  > **Comments:**
  > **username_1**: For view-only, you might want to think about doing it as drupal views (via https://www.drupal.org/project/civicrm_entity for drupal 8).  
  > **username_0**: Thanks, I'm looking at this but it seems like a lot of work for providing what seems to be already catered for.  I have to wonder if the built in CiviCRM/Drupal roles implementation is buggy...  
  > **username_1**: It's just read-only is an unusual setup for CiviCRM's "backend" screens. You might be able to do it with ACLs. See https://docs.civicrm.org/user/en/latest/initial-set-up/permissions-and-access-control/  
  > **username_0**: OK I figured it out.  The "edit" capability was set for Authenticated Users.  Moral:  always check Authenticated users.  The default settings may not be what you want...  
  > **username_1**: Ok great! You can answer your own questions on stackexchange by filling out the answer field below - it's encouraged even.  
  > **username_0**: @username_1 thanks for the pointers.  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2021-01-18. Score: 3
  
  So it turned out that the "Contact edit" capability was turned on for the "Authenticated User" role. One needs to remember that Drupal "ORs" the permissions for logged in users in any custom role with the permissions in the "Authenticated User" role.
  
  Always check the defaults before blaming the software!
  
  
  ---
  
  