I've received a couple notices that a few users are not able to login to the drupal 6 site that I have setup. I can see the access denied message in "Recent logs entries" but I'm not given any details as to why the user was denied.
I have looked at the user's account and I can't see anything wrong with the settings. I have tried resetting the password. I had one use that cleared his browser cache on firefox and he could then get in, but I have other users that are only IE users and clearing their cache isn't working. When I try to login as one of these users - I can login without any issues. There was one user that I deleted their account and recreated it - they still can't get into the site.
My only updates to the site today were updating IMC module, adding the Wysiwyg-imc-bridge module and wysiwyg-ckeditor. I also made sure I ran the /update.php file after the module update.
| Attachment | Size |
|---|---|
| access-denied.jpg | 21.97 KB |
| access-denied-page_error.jpg | 59.88 KB |
Comments
user roles
it says that an anonymous was denied -- so anonymous would need permissions -- at least that is where I would start? and I could be all wrong.
maryann king
http://www.emkayandco.com
Ah the old "access denied"
Ah the old "access denied" message.
The misnomer about this message is that it means two things.
It means the user in question does not have permissions to view the piece of content. This ALSO means that the content could be unpublished, and the user in question does not have permissions to see unpublished content.
This threw us for a loop for a couple days until I realized what was going on. This message is ambiguous at best. But Drupal is free, and I can't complain too much.
Hope that helps shed light on the situation.
when I use their login
That would make sense, except for the fact, when I login with this user's credentials - I get logged in just fine.
How would I verify, the user does indeed have access to their "my account" page - which is where users are directed once they log in.
Hmm, I think I am missing the
Hmm,
I think I am missing the root problem your user is experiencing.
It is their account page that they cannot access and get the "access denied" message on?
If so, it could be many things that could be causing that.
But let's start there.
The steps
Here is what my user is doing:
1. They go to the site and click "Sign in to your account"
2. They enter their username (or email address) and password
3. Click "Log in"
Result: At this point they are getting an Access Denied message and they are not logged in to the website. (I've added a screen shot to my original post)
When I login as the user "above":
1. I go to the site and click "Sign in to your account"
2. I enter their username (or email address) and password
3. Click "Log in"
Result: I'm directed to their my account page and I'm successfully logged in.
Thanks!
That clears things up a lot, thank you.
I haven't come across something like this, exactly.
There have been times when a specific user could not log in, but after repeated attempts they could.
The site I am describing was on an EC2 instance, with the DB on a separate instance and I just chalked it up to latency across the network. Since drupal implements write-through caching for their sessions.
Sessions being the device to see if a user is logged in or not.
A quick and dirty solution might be to echo the global $user var on the account page of your site on a dev or staging server to see if you can find anything that might indicate why a user isn't being considered as "logged in".
Not a 100% answer, sorry. The way drupal manages users is a little weird to me, and permissions always seems to be the wall I run into with Drupal installations.
So be sure to check that users can access their user page, and that no other modules are getting in the way of that.
Good luck.
Just another thought I
Just another thought I had.
If your user is not logged in, they would actually see the user login page if they went to /user and were not logged in.
If they are in fact logged in, when they go to /user they should see their profile information.
This may give something for you to go on.
The fact that you are seeing an access denied message from an anonymous user indicates to me that your user was not logged in.
Hope that helps.
Communications from site may yield "Access Denied"
I have found that the messages (contacts, notifications) FROM the site include links to /user/ pages that cannot be accessed until one (a user) is logged-in. More than one user has found it confusing (when clicking one or another of these links), so I decided to change the template of the notices, etc sent so a note tells users that they cannot use
the user links appearing in the email UNTIL they log-in OR they may well see "Accessed Denied" or one other nasty message.
Issue resolved
Okay, it appears that the issue was related to a setting in the settings.php file.
When setting up the new wysiwyg editor I had enabled the $cookie_domain = 'mywebsitedomain.com';
Once I commented out/disabled this setting my user's login problems seem to be resolved. This solutions doesn't make any sense to me but it is working.
Well, apparently the session
Well, apparently the session id is stored in the cookie.
If that cookie is domain dependent, it may cause issues.
The session id is used to find the session information in the DB which indicates whether a user is logged in or not.
Why different domains would make this an issue?
I can't answer this unless I knew more about your environment, but I am glad you got it figured out.
I have been burned by $cookie_domain before as well. :-)