ACLs and Smart Groups problem

[P a u l]

I am using 4.5.4, and wordpress 4.

I can't get smart groups to work with a wordpress login. I want chapter admin logins to only be able to see their members. I've set up roles, ACLs, smart groups, and nothing works so far.

[Coleman Watts]

Could you be about 100 times more specific about what you've tried, with screenshots.

[P a u l]

Could you be about 100 times more specific about what you've tried, with screenshots.

Call the target chapter ChapterA...

1. create wordpress role "ChapterA Staff". Give it all capabilities for now.
 
2. create wordpress account "ChapterA Staff". Assign the ChapterA Staff role.

3. create new group: ChapterA Staff (normal group) and add ChapterA Staff account added in step 2, then create group "ChapterA Members" (smart group, based on search criteria for ChapterA members). Verify smart group works.

4. CiviCRM » Administer CiviCRM » Option Groups » Access Control » Manage ACL Roles: create role "ChapterA Staff".

5. CiviCRM » Administer CiviCRM » Access Control » WordPress Access Control: allow ChapterA Staff various permissions, including View all contacts

6. CiviCRM » Manage ACLs » Access Control » Assign Users to Roles: assign the ChapterA Staff user to the ChapterA Staff role.

7. CiviCRM » Manage ACLs » Access Control » Manage ACLs: create the permission for ChapterA Staff role to edit the smart group ChapterA Members.

Now login as ChapterA Staff, and see that searching on contacts results in all contacts, not restricted to ChapterA Members. The expected result is that the ChapterA Staff login will only see ChapterA Members. Similar result on a member search, you see all members. If I unselect "View all contacts" in the access control, I see no contacts or members at all. So based on the above, I don't think I have set it up correctly, or there is some problem with the software.

[JonGold]

A couple of questions:
* Can you confirm this works correctly with a non-smart group as the ACL target?
* If you take the same steps on the Drupal demo site (http://demo.civicrm.org) do you get the same results?

I have definitely used smart groups as the target of an ACL before - and distinctly remember when support for that did NOT exist, in the Civi 4.2 days.  So I can confirm that what you're doing SHOULD work...

[P a u l]

A couple of questions:
* Can you confirm this works correctly with a non-smart group as the ACL target?
* If you take the same steps on the Drupal demo site (http://demo.civicrm.org) do you get the same results?

I have definitely used smart groups as the target of an ACL before - and distinctly remember when support for that did NOT exist, in the Civi 4.2 days.  So I can confirm that what you're doing SHOULD work...

I replaced the smart group with a static group of members (the only change) in "CiviCRM » Manage ACLs » Access Control » Manage ACLs", and the ACL feature worked immediately. This is very interesting. Now I need to learn why the smart group is not working. To me this is like the LocNess monster of features -- people say they have seen it, but no one has proof. I need step by step known good procedures.

Days ago I read the a section of the book that made a parenthetical comment about this working only on Drupal. I need to find that section again.

I have had a few suggestions to test bugs on the demo site. Well, you can't test payment gateway workflows because you can't set up payment gateways on the demo. And you can't test the ACL issue on the wordpress or drupal demos because you can't create users.

(To test this out further, I set up CiviCRM with Drupal on my own server and after a day or so was finally able to get to the CiviCRM menus. Then after a few more hours on Drupal, I was completely unable to create a new admin user that had access to any admin menus. Drupal is completely obscure to me, and I can usually figure stuff out. I have been a software engineer for over 30 years, and couldn't figure out Drupal. So I have not been able to test this on Drupal.)

I filed this as a bug: CRM-15662.

[JonGold]

For reference, this is the original bug: https://issues.civicrm.org/jira/browse/CRM-10135

[P a u l]

For reference, this is the original bug: https://issues.civicrm.org/jira/browse/CRM-10135

Thank you. I feel this is not really fixed.

BTW, the workaround posted by Peter Davis in CRM-10135 does not work for me.

[Donald Lobo]

1. might want to check the thread here: http://forum.civicrm.org/index.php/topic,34919.msg148602.html#msg148602

might have some tips

2. giving "view all contacts" will defitely override any acl's since thats an all inclusive permissioning

3. would be good if you can see how this works in drupal and then debug in wordpress. We need more folks testing and submitting patches for the WP integration

lobo

[P a u l]

1. might want to check the thread here: http://forum.civicrm.org/index.php/topic,34919.msg148602.html#msg148602

might have some tips

2. giving "view all contacts" will defitely override any acl's since thats an all inclusive permissioning

3. would be good if you can see how this works in drupal and then debug in wordpress. We need more folks testing and submitting patches for the WP integration

lobo

Thank you. "view all contacts" is really not in play here as I have tried it both ways. The ACL permissions definitely work for static groups but not for smart groups. In my opinion...

I studied the thread you refer to and can't understand it. They refer to testing on the demo site, and as I have already said, it is not possible to test there since you will not have control over new users or permissions.

And also as I said, Drupal is way beyond my understanding. My project for the non-profit is Wordpress only. I have promised to set this up for the organization that I belong to, and so far, I can't fix this. Perhaps they can hire an expert.

I will certainly add anything I find that is relevant, and I support your efforts.

[diegov]

Hi, I have the exact same issue here, with Civi 4.5.4 and Joomla! 3.3.6. Confirmed that the same ACL works fine with standard groups and doesn't with smart groups. I tried the re-saving as mentioned in the Issue 10135 and it didn't make any difference.

I find a message (http://forum.civicrm.org/index.php/topic,34174.msg144933.html#msg144933) about a script to sync groups (Smart with Standard group) to make it possible to alleviate the problem, unfortunately it's for Drupal only.

[P a u l]

I filed this as issue CRM-15662, which is now marked as fixed. It's starting to looked fixed to me after applying the one line fix. I had to start over with a new user, role, smart group, and acl, to get it to work.