Allow individuals to contribute ... on behalf of an organization

[joemaine]

Here's a problem that I've been able to duplicate on the sandbox.

My assumption is that if "Allow individuals to contribute and / or signup for membership on behalf of an organization?" is enabled then when an individual is viewing the "Member Signup and Renewal" Form with "I am contributing on behalf of an organization." selected that the "Organization Details" box should show both: "Create new organization" and "Select existing organization".

However, for most "individuals" (and I can't determine any commonality) only the "Organization Name" box appears.

What am I missing??

[Dave Greenberg]

The expected behavior is to present the "Select existing organization" option only for authenticated (logged in) users who have an existing permissioned relationship with one or more organizations. For those folks, we should be listing only the org's they are "connected to" in the selector.

This is described here in the implementation issue (http://issues.civicrm.org/jira/browse/CRM-2964):

2.3 Logic for authenticated user
If the individual is authenticated, we can check for existing permissioned employee<->employer relationships. If found, use the radio button + dojoComboBox interface to allow them to select an existing related organization or enter a new one.

The reason for this is that exposing your entire list of existing organizations to either anonymous or authenticated users in an Ajax auto-complete selector seemed like a bad idea.

[joemaine]

Hi Dave,

I understand the logic; and it makes perfect sense, but in the sandbox, the individual was an authenticated user and did have an employee<->employer relationship - yet the auto-complete selector didn't appear.

[Dave Greenberg]

Joe - Just re-checked this on the Drupal demo with the demo / demo login. Initially the demo user had an employee relationship with AAAA Org - BUT it wasn't "permissioned". I updated the relationships - checking the box for "'Susan Demouser' can view and update information for  'AAAA ORG'" at http://drupal.demo.civicrm.org/civicrm/contact/view/rel?action=update&reset=1&cid=102&id=162&rtype=a_b

Then I went to test-drive the Membership Signup form and I get the expected combo-box with AAA ORG in it.

If there is another combination of conditions that doesn't work as expected - please recreate on demo and post back here.

Thx!

[joemaine]

Hi Dave,

bummer...now I need to rethink my workflow...again.

I had hoped that any employee of a company (established relationship) would be able to use the contribution pages with the auto-complete selector box enabled. Many employees may be contributing on behalf of an employer (rentals, memberships...) but I don't want any employee to be able to edit the CiviCRM organization record. I also found out that turning off permission to "Access Contact Dashboard" disables the functionality of the auto-complete selector on the contribution pages (the box appears, but doesn't work).

We're pushing the use of CiviCRM in a bit different direction that the original design, so our needs are a bit unique, but if we can work through some of the issues, we'll be able to open up a large market (trade associations, chambers, similar types of *organizational* focused orgs). We'll keep at it...we're too far down the road to give up now ;-)

Too bad you're way out on the left coast, it would be great if we could get you to Maine (the 'right' coast) to talk to our Drupal Users Group (about CiviCRM) and spend the day with us to learn about what we're trying to do...

Kudos to you and your team for actively responding to all things CiviCRM!

Thanks Dave!

[Dave Greenberg]

I suspect that changing the business logic to allow auto-complete for non-permissioned employees would be a fairly trivial change (hack). Grab us on IRC if you're interested in pursuing that. (Since you're using 2.1, you could use the custom PHP file path feature to have a custom copy of the specific PHP file for your install.) Going forward, you should consider what changes would be needed in the out-of-the-box configuration options to support use cases like yours - and possibly contribute a patch for this in 2.2+.

I'd love to visit Maine at some point - although not sure when that can happen. In the meantime we are looking at running a training and / or user group meeting on the east coast in March (New York or DC?) - around the time of Drupalcon. I'll post a blog on this in the next day or so. Perhaps you can join in.

[joemaine]

Hi Dave,

I'm still not comfortable with doing any hacks yet, so I'm trying to work within the existing framework. By following your suggestion to set up an employee as permissioned I ran into the following items - which seem to be a security issue for organizations. In order to enable the auto-complete functionality within CiviContribute an authenticated permissioned-employee user ends up with the following capabilities from CiviCRM:
>>can edit employer data
>>access activities history and create new activities
>>view and open cases
>>view, edit, disable and delete own relationships
>>view and add notes
>>edit tags
>>view the change log
>>send email from within CiviCRM to any email address (which also changes the primary email address for the contact)
>>can schedule a meeting and view all database contacts
>>can delete themselves or the employer

Is there a security setting I'm missing? Here are the access permissions that are turned on in the CiviCRM module are:
>>access CiviCRM
>>access CiviMail subscribe/unsubscribe pages
>>access all custom data
>>make online contributions
>>profile listings and forms
>>register for events
>>view event info

Yikes!

[Dave Greenberg]

Joe - thanks for pushing on this a bit. The functionality is supposed to work for authenticated users with "access CiviCRM" permissions OFF ... which I believe will resolve your permissions concerns below. However, there is a bug in the permissioning logic currently. I've re-opened the original issue - and expect this will be fixed quickly - with the fix included in the next 2.1 update. You can track progress here:

http://issues.civicrm.org/jira/browse/CRM-2964

[joemaine]

Hi Dave,

Fast response as always!

Two permissions-related bugs. This authenticated user functionality needs to work when 'access CiviCRM" is FALSE:

1. The dojo comboBox for "Select existing organization" does not retrieve valid permissioned relationships for an authenticated user if "access CiviCRM" is FALSE.

I like #1 - this will resolve the issue, and I'll be able to turn off user access to CiviCRM

2. The "Edit Contact Information" form returns "Access Denied" when authenticated user links to it from the Contact Dashboard if "access CiviCRM" is FALSE (this form should be available in this condition). ( civicrm/contact/relatedcontact?action=update&reset=1&cid=1 )

I'm not sure I agree with #2. When I turn off access to CiviCRM, I don't want the individual to be able to edit any data on the Civi Contact Record Page, and don't want access to be available from the Contact Dashboard - I've created profile pages for that purpose. If you're going to allow folks to edit from the Contact Dashboard, please give the option to turn that link off in the Global Settings. I really like the options at Settings-Site Preferences-Contact Dashboard and can envision a time when the selections are built upon other modules and permissions can be granted by role.

Thanks Dave!

[Dave Greenberg]

Edit access is limited to a special contact edit form - not the full contact summary with tabs etc. That said, you can already turn off that part of the Contact Dashboard - uncheck the "My Contacts / Organizations" option in Site Preferences >> Contact Dashboard.

[joemaine]

Thanks Dave!

[petednz]

Dave - can you just clarify the bare minimum permissions required for an Authenticated User to be able to "Edit Contact Information" for an Organisation that they have permission via Relationships to "view and update information for".
Obviously they need
- Access Contact Dashboard

But above/below you say 'don't need Access civiCRM' (though I realise this was to do with Contribution pages etc rather than My Dashboard but logic should be consistent I think) so what do I need so the User can click on "Edit Contact Information" for the Organisation on the Dashboard? Tried "Edit all Contacts' but doesn't seem to hold the key.

cheers

[petednz]

From my testing, I only get this when I give AuthUser 'access civiCRM' which obviously gives too much access.

[petednz]

Maybe I should start a new thread for this - here - http://forum.civicrm.org/index.php/topic,5645.0.html