Customizing Drupal - Part 4 Users and Access Control

By now, you've probably got your site up and running, and you've put some customized conent on your site. Perhaps you've put a few pictures up for your family, and they want a login for your site. You could make it so that a user can only see parts of the site, or certain types of conent, by setting up users, user roles, and then modify the access control for your site.

Lets start by deciding how we want our site to handle new users. Lets go to Administer-->User Management-->User Settings. This is the page where we customize how our site handles users.

The most important thing to note here is right at the top, which is how new users can be added to your site. You can choose to have people sign up and verify automtically via email, which is how I do it at www.linuxbasement.com, you can have it set up so that you have to approve the account, or you can set it up so that only you can set up accounts. This third option is very handy for business sites that only want their internal users to have accounts for the site.

It should be noted that there is much more customization you can do on this page, including support for user pictures. This is beyond the scope of this tutorial, but you should have a look at these settings, as they are quite intuitive.

Now that we've decided how our users can be created on the site, lets go ahead and set up a few roles. Go to Administer-->User Management-->Roles. By default, Drupal sets up two roles, Authenticated user, and anonymous user. One for users logged in, and one for users not logged in. I usually go ahead and add admin as well, so that I can set up additional administrators for the site. If you are the only one administering, there is no need for this.

Today, I'm going to add a new Role called Moderator. That way, I can assign people who are active in the forums the right to moderate. To add the role, you simply type in the name of the role you want to create and click "add role".

 Now that I have a new Role called moderator, I'm going to edit the permissions for that role by clicking on "edit permissions". You could also edit the permissions for all roles by going to Administrator-->User Management-->Access Control.

Here you will see a long list of options for giving control over your site to this role. Take note that for every module that you install, there are usually access control switches that come along with it, so when you install a new module, you should come over to access control and give control of the module to whatever role you wish.

Lets scroll down and find the Forum access control options. I'm giong to give full controll of the forum module to our new moderator role.

Now just scroll down to the bottom of the list, and save permissions. There has been some significant inprovments on the access control page in Drupal 6, which I will cover when it is fully released.

Now we have a new role, but no one has been assigned to it. Lets go over to Administer-->User Management-->Users and set someone up as a moderator. You may need to create a user, which you can do by selecting the "add user" tab. In my case, I already have a user that I would like to promote to Moderator, so I'm going to scroll down until I find the user.

If you are creating the user from scratch, you will notice you can assign the role right at user creation. In my case, I'm going to edit the user, and add the role, by putting a check mark next to "moderator" within the user's page.

Now scroll down and click submit, and you now have a user that can moderate your forums. Cool! While you are in the user edit page you may want to have a look at some of the other options.

That's it, you now have a site that can have many users, assign those users to roles, and have them access only certain portions of your site, or perhaps help maintain the site, or you can set up certain types of content that they can create. More on that next week.