CiviCRM Community Forums (archive)

I am setting up Drupal user rights and CiviCRM ACL's.

I made 5 specific Drupal users, User A - User E (I don’t use Drupal's anonymous user and authenticated user). All users have their specific rights.

I made 5 Groeps for Acces Control (Grp A- Grp E) and made ACL Roles, ACL A - ACL E.
I did give them a weight number: 1 to ACL A, 2 to ACL B, ..., 5 to ACL E, where 1 is less important then 5. I noticed that a larger weight number overrules a smaller number. (Is that correct  ).
I assigned Drupal users to ACL roles: User A -> ACL A, User B -> ACL B,.......

So I have 5 users (5 access groups and 5 acl roles) with increasing value of access rights: User A (low) - User E  (high).

In Drupal:
I give ‘access to CiviCRM’ and ‘add contacts’ to all the users.

In ACL:
I make some permissions for groups in Manage ACL's

Perfect: this is all working fine!! All the Users (A - E) have there own group access.
---------------------------------------------------------------------

Then in Drupal:
I give Access to CiviContribute and CiviMember to User C
I give access to Civimail to user D

When user C clicks on CiviMember in the dashboard main menu the browser is freezing, searching for page... and after a while I get a blank page. I did a few test and noticed that my server load goes extremely high. I have no error notifications.

It looks like a memory problem. I increased the php memory to 80M (default = 64M), did not help.

I switched of all the ACL's, that did help: User C gets his Members page (Membership Summary). In this screen, clicking on a membership members count  (to show the members of the members type) the result is a (find members) page with an incorrect count of members and an incorrect overview of members. In real: I have 1 membership type with 11 members. It shows 1 member and the count is 48 members  When logged in as admin (id 1) the overview is correct.

Switching off the ACL’s is not an option (because of the different group access rules for all the users), and I want to give user C the access to CiviMember.
The access to CiviContribute to User C and CiviMail to User D gives no problem (I am not yet ready with this setup but it looks ok).

I checked the Civimember count on the test site http://demo.civicrm.org/drupal/civicrm/member?reset=1 .
I noticed that the total counts 2007-new/renew and totals current# in the member type table where 17 and 10. When I clicked on these totals the count and overview was 20 and 12. Normally these counts must be the same.

are smart groups involved in your ACL? Due to limitation with mysql (and our lack of knowledge about it apriori), smart groups and acl's are not very efficient (or to put it more blunty, they are extremely inefficient!). So i would recommend doing acl's on static groups only for medium-large sized sites. We hope to rectify this issue by restructuring search and working around mysql inefficiencies (the sub-select optimization is still not present in mysql 5.x

lobo

Forget to mention: The database has less then 800 contacts.

msn:

can u send me a copy of your civicrm 1.9 database along with all the ACLs etc. I'd like to figure out see the queries generated and what we can do to optimize them. Would be great if we can chat on IM / IRC and run thru your scenarios, whats happening and why

you can email it to me at donald.lobo at gmail. I'll destroy it when i'm done with it, will respect its confidentiality etc

thanx

lobo

Hello Lobo,

Because I had other activities the previous weeks, I was not able to react.

I know of the bug CRM-2404. If I eliminate ACL however, the counting is correct. At this moment, with a few groups in ACL the counting is also correct. Therefore my idea is that the bug is related to ACL use.

I have sent you a copy of our database and want to ask you if you had time to analyse the db and can you make some conclusions?

Regards
Martin