With multiple businesses in same Moodle instance, how to hide certain classes and categories from certain users

With multiple businesses in same Moodle instance, how to hide certain classes and categories from certain users

by Marty Atkins -
Number of replies: 12
I know this may sound like it has been discussed before, and if it has I apologize. I've looked in the forums and have seen a few people touch on this subject, but not completely cover what I'm needing.

I've been playing around with the "hiding" visibility and role configurations for the past several weeks and cannot for the life of me get the visibility of categories and classes to work the way I need them to.

I am integrating different businesses in the same instance of Moodle. I have structured the categories like so:

  • Sitewide
    • Business A
      • Contractors
        • Class AC101
        • Class AC102
      • Full-time employees
        • Class AF101
        • Class AF102
    • Business B
      • Class B101
      • Class B102
    • General Public
      • Class G101
      • Class G102

1) I cannot allow Business B authenticated users to see Business A's categories OR classes.
2) I do not want Business A's Contractor authenticated users to see Business A's Full-time employees category or classes.
3) I want all authenticated users to see the General Public category and classes.

I've tried various combinations of hiding these classes from authenticated users at category and course levels. I have tried creating a separate role for Business A's Contractor authenticated users (inheriting from the default authenticated user role), overriding this custom role's permissions to allow to "see hidden categories" and "view hidden courses".

None of this is working, and it seems I have tried every combination of hiding categories/classes, custom roles and permissions...but maybe I haven't thought of that particular permutation that would make this work.

Can you please help me? I would forever be in your debt smile
Average of ratings: -
In reply to Marty Atkins

Re: With multiple businesses in same Moodle instance, how to hide certain classes and categories from certain users

by Ron Meske -
Picture of Particularly helpful Moodlers
Hi Marty,

We would like to configure Moodle the same way. The general concensus at this time is to use Moodle Networking and using a installation for each company. The reason is that anyone with a role higher then Student can see all Categories, and if your goal is that they should not see them then you really need multiple installations. Here is a link to a discussion that is very similar to what you would like to do http://moodle.org/mod/forum/discuss.php?d=98359 and includes details on how someone went about setting it up.


Average of ratings: -
In reply to Marty Atkins

Re: With multiple businesses in same Moodle instance, how to hide certain classes and categories from certain users

by Ron Meske -
Picture of Particularly helpful Moodlers
Hi Marty,

Just as a follow-up, there is one way to accomplish sort of what you want by using the My Moodle page. With admin controlled enrollment and turning off the Course Search function, the user would only see those courses they are enrolled in.
Average of ratings: -
In reply to Ron Meske

Re: With multiple businesses in same Moodle instance, how to hide certain classes and categories from certain users

by Marty Atkins -
Thank you for the reply, Ron.

There's something either fundamentally I'm not getting about the role system or the role system isn't functioning properly. I'd love to at least qualify this smile
See if this makes sense to you...

I create a custom role and inherit Authenticated user's permissions. I call this custom role "Authenticated user (Business A)". I have a hidden category called "Business A" with two visible classes underneath. Under the "Business A" category, I choose Assign Roles. I click the Override permissions tab, and the page contains the header "Override permissions in Category: Business A". I then select the custom "Authenticated user (Business A)" role and choose to Allow that role to "See hidden categories". I then switch over to the "Locally assigned roles" tab and add "Student A" to the "Authenticated user (Business A)". I'm hoping this would allow "Student A" to see the "Business A" category and its two associated classes when this user logs in, but it doesn't.

When I click on the link "See hidden categories" in the Override permissions screen, moodleDocs states:
  • This allows a user to see hidden course categories.
  • This capability may only be applied in the system context i.e. as a global role.
...which doesn't explain why, if I go to another category "Business B", the permission override that I applied in "Business A" doesn't appear to be applied globally. So the fact that the "Authenticated user (Business A)" permission override "See hidden categories: Allow" isn't reflected in the "Business B" category coupled with the header stating "Override permissions in Category: Business A" leads me to believe that "Student A" should see the hidden "Business A" category and the visible classes underneath. Am I wrong about this?

For good measure, I've tried supplementing this with enabling "Allow visible courses in hidden categories" in Front Page > Front Page settings, to no avail.

I have literally been hung up on this for weeks. Thanks again in advance for your help!
Average of ratings: -
In reply to Marty Atkins

Re: With multiple businesses in same Moodle instance, how to hide certain classes and categories from certain users

by Ron Meske -
Picture of Particularly helpful Moodlers
Hi Marty,

You are not doing anything wrong. I went round and round with this and even installed the Roles Debug add-on to calculate permissions. The roles/permissions just do not work the same as what I am used to with other applications like a DMS. I am working on a document to describe what would be ideal for hidden categories and courses, to submit as a suggestion for a future version. I just don't have time to spend learning how the logic currently works in the code to make the fix myself.


Average of ratings: -
In reply to Marty Atkins

Re: With multiple businesses in same Moodle instance, how to hide certain classes and categories from certain users

by Matt Campbell -
To help address the roles and hidden categories issue, take a look at MDL-16013 - I encountered this a month or so ago and it seems to me that we need a small change to Moodle core to resolve this. If you think this fits your needs, please vote for the change - and I've also detailed what changes you would need to make to core, so you could apply that to a test site and see if it resolves your issue.

We are using this fix on our production site to give certain users access to just their categories, and give them the category URL to access it.

Thanks,
Matt
Average of ratings: -
In reply to Matt Campbell

Re: With multiple businesses in same Moodle instance, how to hide certain classes and categories from certain users

by Ron Meske -
Picture of Particularly helpful Moodlers
Hi Matt,

That is close to what we want. However, what we really want is the ability to have users be able to login and at the front page be able to see all visible categories and also those hidden categories they are assigned to. This allows for a common visible category for all users as well as the ability to see just those categories they are allowed to see.

To achieve what we want to see we gave all users on the front page permissions for moodle/course:update and moodle/course:create. Then within the hidden category we gave them the permission moodle/category:visibility. This gave us the disired listing of categories where those hidden categories they weren't suppose to see were not listed. However it created some usual permission issues:
  1. On the front page, the combination of moodle/course:update and moodle/course:create gave the user the ability of editing the front page settings.
  2. When searching for a course, if a course is visible within a hidden category, the course is listed and the user can enroll in it. Not a desired permission.
  3. They can add a course on the frontpage and assign it to any category they can see. Not a desired permission.
  4. They can update any course. Not a desired permission.
Asside from the undesired permissions of creating and updating courses, for some reason these two permissions combined give us the desired category view on the front page. We just have not gone through the logic to understand why so that we can suggest a fix.

Ron
Average of ratings: -
In reply to Ron Meske

Re: With multiple businesses in same Moodle instance, how to hide certain classes and categories from certain users

by Matt Campbell -
I would definitely not give all users the front page permissions you did - what we're doing is at the category level, although we did assign it to one user at the system level - she's able to see the visible category structure and then click on a category to see what's hidden inside it - she doesn't get the view I do as administrator.

Haven't worked it all out, but you definitely need to pull the moodle/course:update and moodle/course:create from the front page. I'm doing it all with the code change I gave in MDL-16013 and creating a role with just moodle/category:visibility. About the only thing you're looking for that I haven't figured out is how to make it hidden categories visible at the front page level - I'm thinking that would entail digging into /course/lib.php - probably in the functions that control the category listing - possibly print_whole_category_list or some such.

Thanks,
Matt
Average of ratings: -
In reply to Matt Campbell

Re: With multiple businesses in same Moodle instance, how to hide certain classes and categories from certain users

by Ron Meske -
Picture of Particularly helpful Moodlers
No we have not actually given all users those permissions on the front page, we just looked at front page permissions to determine when a hidden category was shown. We had isolated it down to those two permissions before we basically ran out of time.

After discussing this again and knowing those two permissions I went through the code again this morning and was able to find the two modifications that have to be made to make this work. We can now set an over-ride permission for a role in a hidden category and all users assigned that role in the category can now see it on the front page and they will not see other hidden categories they do not have permission to see. So we are part way there.

The next issue to solve is with the search function. It returns all unhidden courses found even if the category is hidden. Which is not desirable but understandable. Hiding all courses in a hidden category solves the issue but it is an extra step that can be missed.

We also do not know if in making these changes we have broken any functionality, if anyone would like to help test them we can supply the information on the modifications needed.

Ron
Average of ratings: -
In reply to Ron Meske

Re: With multiple businesses in same Moodle instance, how to hide certain classes and categories from certain users

by Marty Atkins -
I would most definitely like that code change to test it. I have a week off next week that I can devote to completely resolving this, and it's pertinent that I do smile

Thank you all for the wonderful collaboration on this issue!
Average of ratings: -
In reply to Marty Atkins

Re: With multiple businesses in same Moodle instance, how to hide certain classes and categories from certain users

by Ron Meske -
Picture of Particularly helpful Moodlers
To allow a mix of visible and hidden categories and to control which hidden categories a user can see and access the following conditions must be met:
  1. Hide all Categories, including sub-categories that you want only selected users to see.
  2. Hide all courses in the hidden categories. Note: If you do not hide the courses, then the search function will list them even if the category is hidden.
  3. For each role that will be used within the hidden categories you need to assign the permissions moodle/category:visibility and moodle/course:viewhiddencourses. Note: If your courses use a default role of Student then you will need to give that role the above permissions. Also, do not assign the above permissions to guests, authenticated users or the default site role of a logged in user.
  4. Assign users to the appropriate role based on the category they have permission to access. Remember at whatever level you assign a user a role with the permission to see hidden courses and categories, they will have that same permission on all sub-categories unless it is otherwise over-ridden. Note: The combined permissions of moodle/course:update and moodle/course:create will have the same effect as moodle/category:visibility. Any user assigned to a role with those permissions will also see the hidden categories. To change this would require more extensive changes.
There are two files that must be modified to provide this level of control over hidden categories:
  1. In course/lib.php locate the function print_whole_category_list (line 1646) and change the following code:

    if ($category) {
    if ($category->visible or has_capability('moodle/course:update', get_context_instance(CONTEXT_SYSTEM))) {
    print_category_info($category, $depth, $files);
    } else {
    return; // Don't bother printing children of invisible categories
    }

    to:

    if ($category) {
    if ($category->visible or has_capability('moodle/course:update', get_context_instance(CONTEXT_SYSTEM))or has_capability('moodle/category:visibility', get_context_instance(CONTEXT_COURSECAT,$category->id))) {
    print_category_info($category, $depth, $files);
    } else {
    return; // Don't bother printing children of invisible categories
    }

  2. In course/category.php locate the following code (line 51):

    if (!$category->visible) {
    print_error('notavailable', 'error');

    and change to:

    if (!$category->visible and !has_capability('moodle/category:visibility', get_context_instance(CONTEXT_COURSECAT,$category->id))) {
    print_error('notavailable', 'error');
By making a course or category hidden, the text color will be different then non-hidden items. If this is not a problem then you do not need to make any additional changes, however, if you do not want this to be obvious to users, then the functions print_course and print_category_info need to be modified to change the setting of class=dimmed if a course or category is hidden. The reason for changing the code is so that other items set to hidden will still be displayed properly.

Let me know how your testing goes.

Thanks,
Ron
Average of ratings: Useful (1)
In reply to Ron Meske

Re: With multiple businesses in same Moodle instance, how to hide certain classes and categories from certain users

by Marty Atkins -
Thank you very much for the code change, Ron! It seems to work perfectly except for the case when you have the following category/class structure:
  • Sitewide
    • Business A
      • Contractors
        • Class AC101
        • Class AC102
      • Full-time employees
        • Class AF101
        • Class AF102
    • Business B
      • Class B101
      • Class B102
    • General Public
      • Class G101
      • Class G102
1) I want to hide Business A from Business B, not allowing companies to see any other companies in the system (including even category labels)...as if they were the only company in the system.
2) I want to hide the Full-time category and classes from the Contractors...as if the Contractors were the only "Business A" group in the system.

I created a system role of "Authenticated User (Enterprise)" by inheriting the standard Authenticated User role and adding "See hidden categories" and "View hidden courses" permissions. If a user is added to the "Authenticated User (Enterprise)" role at the "Business A" level, this user can now see both the "Contractors" and "Full-time employees" categories and associated classes.

I can't think of a way to apply the "Authenticated User (Enterprise)" role at the "Business A" level to achieve the first point above and still be able to satisfy the second point above without flattening the category structure to:

  • Sitewide
    • Business A (Contractors)
      • Class AC101
      • Class AC102
    • Business A (Full-time employees)
      • Class AF101
      • Class AF102
    • Business B
      • Class B101
      • Class B102
    • General Public
      • Class G101
      • Class G102
Am I missing something, or can I have my organizational "cake" and eat it too? smile Again...thank you for all your support!
Average of ratings: -
In reply to Marty Atkins

Re: With multiple businesses in same Moodle instance, how to hide certain classes and categories from certain users

by Ron Meske -
Picture of Particularly helpful Moodlers
When you have sub-categories you have to do a little more work. You must create a role for each sub-category. So instead of just Authenticated User (Enterprise), also create Authenticated User (Contractor) and Authenticated User (Employee) give both view hidden categories and view hidden courses.

Then in Business A assign your users to one of the two new roles, not using the Enterprise one. To prevent the users of Authenticated User (Contractor) from seeing the Employee sub-category, you have to override the permissions of the role within the sub-category. So, for the Employee sub-category you need to override the permissions using prevent for view hidden category and view hidden course for the Contractor role. And then in the Contractor sub-category you would do the same for the Employee role if you want to prevent employees from seeing the Contractor role.

For Categories that do not have sub-categories, like Business B, you can assign users to the Authenticated User (Enterprise).

This should deliver you the organizational "cake" you want and be able to enjoy it too. big grin

Note: Any user with the Assign Roles permission will be able to see all users. There is currently no way to filter the list of users. That may be the next thing we look into.
Average of ratings: Useful (1)