You do not have permission to access this page

[perlwonk]

 Hi, I'm perplexed. I'm working with a new installation of CiviCRM/Standalone and I'm trying to set up a user to help me add contacts. Here's what I've done so far:

1. Created a group called "Navigator Recruiter"
2. Created a group called "Navigators"
3. Added a new user "Donna", and added her to the group "Navigator Recruiter"
4. Created a openid for her, and checked the "Allow to login" box.
5. Created a ACL Role:  "Portland Navigator Recruiter"
6. Configured the ACL so that role "Portland Navigator Recruiter" can edit members of the group "Navigators".
7. Assigned the role "Portland Navigator Recruiter" to the group "Navigator Recruiter".

Now, when I log in to civicrm as Donna, using her openid, I get this message:

"Sorry. A non-recoverable error has occurred.
You do not have permission to access this page"


What am I missing?

[Donald Lobo]

Did u also the give the ACL role "Portland Navigator Recruiter" the "access CiviCRM" permission?

lobo

[perlwonk]

I don't see how to grant civicrm access permission to a ACL role other than the core ACL roles. Other than that I can only see how to grant it to individuals.

I think I got it working though. Here's what I did:

1. Clicked "Administer CiviCRM"
2. Clicked "Access Controll"
3. Clicked "Manage Core ACL's"
4. Clicked "Edit" on Authenticated
5. Checked "Access CiviCRM" (it was unchecked)

And that did it! Is that what you meant? Is that what I'm supposed to do? Did I open the door to bad guys?

Thanks for your help. -- Chuck

[perlwonk]

Well, it's still not working right. I granted civicrm access rights to the 'Authenticated' role, but the user still can't add or edit contacts unless I also grant edit contact privileges to the 'Authenticated' role. But, doing this grants too much access. She can create administrators. It's just not usable as it is.


-- chuck

[Donald Lobo]

1. can u grant "access civicrm rights" to the "Portland Navigator Recruiter"  role?

2. What happens when u create a new ACL? Does it display the "Portland Navigator Recruiter" role? If so, can you assign "access civicrm" to that role? Does that work?

3. This is relatively new code, so there is a decent chance there is a bug here. If it still does not work, please file an issue with the steps and we'll try to reproduce and fix in the next couple of weeks

4. creating a new forum topic for the same issue is not recommended

lobo

[perlwonk]

How would I grant "access civicrm rights" to the "Portland Navigator Recruiter"  role? I don't see how to do it.

When I create a new ACL, it does display the "Portland Navigator Recruiter" role, I haven't seen that as a problem.

[Donald Lobo]

on a screen similar to this in your install:

http://drupal.demo.civicrm.org/civicrm/acl/basic?action=add&reset=1

you can mark the role as "Portland Navigator Recruiter" and then check "access CiviCRM"

lobo

[perlwonk]

Got it. On the standalone version it's:
Administer CiviCRM -> Access Control -> Manage Core ACLs -> Any Role (Edit), then select the role.


... But I still have a problem. A "Portland Recruiter" still can't I still can't add contacts.  I've checked "access CiviCRM" for the "Portland Navigator Recruiter" role, and I've defined the ACL thus:

Operation: Edit
Type of Data: A group of contacts (Portland Navigators)
Role: Portland Navigator Recruiter
Enabled: checked

The "Portland Navigator Recruiter" role is assigned to members of the group "Portland Recruiter"
I would have expected that anyone in the group "Portland Recruiter" could log in to civicrm, then add a contact, and that contact would be in the group "Portland Navigators"

That's my intention anyway, but it doesn't seem to work that way.

[Donald Lobo]

can you please file an issue. we'll take a look at it in a week or so from now

lobo

[Donald Lobo]

... But I still have a problem. A "Portland Recruiter" still can't I still can't add contacts.  I've checked "access CiviCRM" for the "Portland Navigator Recruiter" role, and I've defined the ACL thus:

To add contacts, you'll need to give the portland recruiter the "add contacts" permission

The "Portland Navigator Recruiter" role is assigned to members of the group "Portland Recruiter"
I would have expected that anyone in the group "Portland Recruiter" could log in to civicrm, then add a contact, and that contact would be in the group "Portland Navigators"

That's my intention anyway, but it doesn't seem to work that way.

when adding a contact the portland recruiter would need to add the contact to the groups he/she has permission to. The list of groups and tags is available at the bottom of the Edit Contact screen. This is not ideal but the system is setup that way for now.

lobo