Understanding Roles, and Assigning Rights

The default Drupal installation comes with two standard roles: anonymous user and authenticated user. The anonymous user is used for any non-members visiting the site, and anonymous users generally have limited rights on a site used for a learning environment. All site members belong to the authenticated user role; consequently, any permission granted to the authenticated user role is given to every site member. In Chapter 2, we assigned privileges to the authenticated user role. As discussed in Chapter 4, the rights assigned to user roles are cumulative; therefore, if a single user is assigned to multiple roles, that user has the accumulated permissions of all roles.

On small sites, some site administrators use the authenticated user role to assign permissions to students. From a technical perspective, this will work, but creating a specific student role (as we did in Chapter 3) provides an additional level of security and flexibility. Later in this chapter we will assign specific rights to the student role.

We will leave the authenticated user role with relatively few rights, and assign more rights to the student role. When working with students under the age of 18, this added level of security can be reassuring to concerned parents. The practice of assigning limited rights to the authenticated user role means that even if someone outside of the course creates an account on the site, they still won't have the ability to do anything until their account has been vetted and approved by a site administrator.

Additionally, as the site grows, it can be useful to use roles to organize users into groups. As an example, let's examine the possibility of inviting parents into the site. If the authenticated user role was being used to control the access rights of students, then all parents would be able to behave exactly like students within the site. By using a separate student role and leaving the authenticated user role untouched, parents can be given a different set of rights than their children.

Unfortunately, Drupal's access rules cannot be similarly extended to govern parent behavior in the brick and mortar classroom.