Introduction
Drupal lets you limit access to content, features, and administration settings based on a system of roles and permissions.
This type of system is often referred to as Role Based Access Control (RBAC).
Here's the 3-step process:
- create a role (e.g. Editor)
- assign permissions to that role (e.g. 'can create articles' and 'can delete articles')
- assign one or more users to that role
How many roles you create and how you name them is up to you and your project's requirements.
- you could have roles that are modeled on existing real-world departments in your organisation, such as 'editors', 'translators', 'management'.
- you could have roles named 'members', 'partners', 'vendors'.
- you could have a single 'administrator' role if only you and a handful of people manage the whole site.
Once a role is added, you can assign to it one or more permissions.
Permissions are defined by Drupal itself, as well as by additional modules you enable. If, for instance, you were to enable the Contact module (which lets you create contact forms), a new set of permissions will become available:
- Administer contact forms and contact form settings
- Use the site-wide contact form
- Use users' personal contact forms
Note:
- Drupal's roles and permissions are cumulative.
- negative permissions (restrictions) are not possible.
The more roles a person has, the more permissions that user has been granted. As permissions cannot be restrictive, a role cannot take away permissions, only give more permissions.
This also means that it is impossible for Drupal roles to conflict with each other, as is be the case in other systems where one role can grant a specific permission and another role can deny that same permission, effectively causing a conflict if a user is assigned both those roles.
Drupal has two special, system-defined roles which cannot be removed:
- The Anonymous user role, assigned to every visitor to the site who is not logged in. Be very careful when assigning permissions to this role: every non-authenticated visitor will have all the permissions assigned to this role. Do not give this role administrative privileges, and consider other options before letting this role create content.
- The Authenticated User role, assigned to every user who logs in to the site, regardless of any other role that might also be assigned to that user. Assign this role permissions that are common to all (non-anonymous) roles, and then add specific permissions to other roles in a granular fashion.