Roles and permissions¶
Know where a role applies, which roles a site offers, and which Sites permission opens which power.
Platform roles and per-site roles¶
A role on the user account is a platform role: it applies on the hub and on every site. A per-site role is the same kind of Drupal role, assigned to a user on one site. Its permissions apply while that site is active, on top of the platform roles (People).
Per-site roles are assigned on the site's People page (Members and roles), or in the Roles table of the user edit form, which takes Administer roles and permissions.
A per-site role never stands for a permission that controls the platform: Administer sites, Administer sites configuration, Access disabled sites, Bypass content access control, Administer roles and permissions, Administer users, and core's administration of modules, themes, site configuration, account settings, software updates, and configuration import, export and synchronization. Only a platform role grants them.
An administrator role held on a site stands for every permission that core does not mark "Give to trusted roles only". Add such restricted permissions under Administrator roles on a site at /admin/sites/configuration/general.
Roles a site offers¶
A per-site role counts only on a site that offers it. The site type's Assignable roles settings list every role except Anonymous and Authenticated, and its defaults decide which roles its sites offer. Where the type makes them Available, each site changes its offer in its own Assignable roles section (Site types).
An assignment of a role the site does not offer stays stored and grants nothing. The access report strikes it through.
Separate powers¶
| Power | Permission | Granted as |
|---|---|---|
| Create, clone, run and delete every site | Administer sites | platform role |
| Site types, Sites configuration pages, status and access reports | Administer sites configuration | platform role |
| Open a site's dashboard | Access the site dashboard | per-site role |
| Change a site's setting sections except Identity, work its launch checklist | Manage site settings | per-site role |
| View a site's people, remove them, grant the site's roles | Manage site members | per-site role |
| Search the platform's active accounts and add them to a site | Add existing users to a site | platform or per-site role |
| Read the access reports | View site access reports | platform or per-site role |
| Reach a disabled site | Access disabled sites | platform role |
Administer sites covers the per-site powers on every site, Administer sites configuration the reports; neither covers the other, and the per-site permissions are independent. A per-site permission in a platform role applies on every site. All permissions: Permissions.
Manage site members adds nobody: give the roles that add people Add existing users to a site as well. Updating Sites grants it to no role. In a platform role it reaches the sites the user is a member of, like Add content to a site, which includes it.
Users on sites¶
Users are content: an account belongs to the sites it works on, where the site type accepts User content (Content on sites). Membership grants no permission. It decides where editing reaches: a user edits content that belongs to sites only when they take part in its canonical site, as member or per-site role holder. Administer sites is exempt.
A per-site role works with or without membership; the People page shows Member or Role only.
Who sees which users¶
- Administer users or View user information in a platform role shows every account.
- Manage site members on a site shows the profiles of that site's members and role holders.
- Editing or deleting an account reaches the accounts that share a site with the editor, and those on no site. Administer sites is exempt.
- A user reference field, like Authored by, offers the accounts of every site, to site managers as well. A user reference field you add offers only the site's members on the site's address when its Filter by site is Filter by the active site.
Do not give site managers View user information, not even as a per-site role: on the site's address it shows every account.