Authenticated users get access denied

Created on 20 December 2024, 1 day ago

Problem/Motivation

Opening this as critical because it's extremely user-facing.

Steps to reproduce

As an admin user, create a new user account, don't assign any roles.

As the new user, log in.

After login, you get redirected to the dashboard, but you don't have access to it, so access denied.

Proposed resolution

Either give authenticated users dashboard access with a minimum selection of blocks, or redirect them to somewhere else?

Remaining tasks

User interface changes

Introduced terminology

API changes

Data model changes

Release notes snippet

πŸ› Bug report
Status

Active

Component

Base Recipe

Created by

πŸ‡¬πŸ‡§United Kingdom catch

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

  • Issue created by @catch
  • πŸ‡ΊπŸ‡ΈUnited States phenaproxima Massachusetts

    I agree that this is both critical and stable-blocking.

  • πŸ‡ΊπŸ‡ΈUnited States phenaproxima Massachusetts

    And it'll need test coverage.

  • πŸ‡¬πŸ‡§United Kingdom catch
  • πŸ‡©πŸ‡ͺGermany jurgenhaas Gottmadingen

    Giving authenticated users access to the dashboard might be an issue as this is an admin page, uses the admin theme, and not every authenticated user may have access to the admin theme. As a result, the dashboard may look awkward.

    We discussed more fine-grained redirects depending upon role and/or permission before. But the dashboard module has the redirect hard-coded, and we can't make any changes, unless they agree to either remove that redirect or make it optional so that we could come up with smart redirects by turning the fixed redirect off.

  • πŸ‡¦πŸ‡ΊAustralia pameeela

    I agree this needs to be fixed in Dashboard, it will be a problem on all sites, not just Drupal CMS.

  • πŸ‡¬πŸ‡§United Kingdom catch

    Let's move this to dashboard, should hopefully just be a permissions check before changing the redirect. Then we can see how that affects Drupal CMS specifically and whether auth users need a custom redirect or not.

  • πŸ‡¦πŸ‡ΊAustralia pameeela

    I created an issue in Dashboard already, should have commented.

Production build 0.71.5 2024