access

There are several easy, handy modules for limiting access to specific nodes. I always have trouble keeping three of my faves straight – partly because they all start with "P" – so here I'll write them down for my reference and yours. (Note: I'm talking Drupal 5.x.)

The three easy P's

"What's the password, Bub?": Protected Node module

This module adds a 'Protected node' item to your node edit forms; if you want to password-protect the node, just hit the 'Node is protected' checkbox, and enter a password. (Passwords are on a per-node basis; you don't set a global password that'll take care of all protected nodes.) There's even a JavaScript-based password quality checker.

On the Access control form, you choose whether to grant a role any access at all to the protected node; those without that access permission head to your "access denied" page. So you get two levels of protection (am I writing a deodorant commercial?): a password needed for any role to view the node, and role-based permission that can prevent a role from even seeing the password input form.

Note: On the Modules form, Protected Node shows up way at top under "Access", not later under "Other". 

http://drupal.org/project/protected_node

"Members Only!": Private module

The Private module adds a simple 'Private' checkbox to a node's edit form. Check it, and the node can be viewed only by the node's author and by roles with the right permissions. Other users get your "access denied" page. 

You set permission to view private-marked nodes via the "Access Control" form, of course. This is a global permission; roles with view permission can view all private-marked nodes. The module doesn't grant the ability to set viewing permissions on a per-node basis.

A good use for this module is to restrict some nodes from anonymous (non-logged-in) users, creating "members only" pages. (You could also grant anonymous users permission to view private nodes, but giving everybody viewing permission makes the module useless! Go ahead and discriminate!)

http://drupal.org/project/private

"Just one bite!": Premium module

This module places its "Access restricted for non-premium users" checkbox under the "Publishing options" item on a node's edit form. It provides a handy middle-ground between no access and Full Monty: roles without "access premium content" permission can see only the node's teaser, followed by a terse "Full text available to premium subscribers only". 

That makes it handy for any site in which everyone gets a sample of the goods, but only registered (which may mean paying) users get the whole thing.

Like the above, users with permission to access premium-marked content will get to access it all; there's no fine-grained control for setting role-based access on a per-node basis.

http://drupal.org/project/premium

Other modules

There are a lot more access-control modules out there, including heavy hitters like ACL and Content Access. See the big list at User access/authentication modules.

I like the above three, though, as light-weight solutions for smaller sites that don't require fine-grained access systems, just a quick way to keep certain nodes out of certain hands. Keep 'em handy in your toolbox!

Just as I earlier had a problem with admins unable to access a Drupal site, I had a problem with visitors unable to access a new site. That is, I could see everything fine as admin, but checking from another (non-logged-in) browser, only the default "Welcome to Drupal" content would show up. (Blocks were visible, but links to nodes in those blocks wouldn't reveal anything. In short, visitors could not access any node.)