Node Access by Field Role
3 sites
No security coverage
This module grants granular control over which users can view specific content nodes. It allows administrators to restrict access based on roles assigned in reference fields or by directly referencing individual users. This ensures that content is only visible to the intended audience, such as sales representatives seeing their assigned clients or developers viewing assigned tasks.
Summary:
Node Access by Field provides fine-grained node access control based on role reference fields and user reference fields.
It allows you to restrict visibility of nodes depending on who is assigned in specific fields or what roles are selected per node.
Features
- Restrict node visibility per role using a "Role access" field (checkboxes with Drupal roles).
- Restrict node visibility per user reference field: e.g. Developer role only sees nodes where
field_developermatches the logged-in user. - Define global full-access roles and global deny roles.
- Configure per-content-type settings with a flexible UI.
- Works with Drupal’s native node access system, Views, and Search API.
- Compatible with Drupal 9, 10 and 11.
Use cases:
- CRM / Sales: Only the commercial assigned to a client (via
field_comercial) can see that client’s node. - Issue tracking: Developers only see the issues where they are assigned in
field_developer. - Knowledge base: Certain nodes in a "Data bank" content type are visible only to specific roles (support, managers, etc).
Post-Installation
- Enable the module (
drush en node_access_by_fieldor via the Extend page). - Go to Configuration → People → Node Access by Field (
/admin/config/people/node_access_by_field) to configure global and per-bundle rules. - To allow per-node restrictions, add the provided Role reference field to the desired content types.
- Clear caches (
drush cr). - Test with different users and roles.
Additional Requirements
- No external libraries required.
- Works with Drupal core only.
Recommended modules/libraries
- Views: to display node listings respecting the access rules.
- Search API: access restrictions also apply to indexed results.