Joomla ACL (Access Control Levels) Setup

Joomla ACL (Access Control Levels) Setup

Joomla ACL is one of the most flexible access control systems among CMS. User group hierarchy, view access levels, permission inheritance — enables any business logic without additional extensions.

ACL Concept

User groups — hierarchical. Inherit parent permissions. Built-in: Public → Guest → Registered → Author → Editor → Publisher → Manager → Administrator → Super Users.

Access levels — define which groups can view element. Built-in: Public, Guest, Registered, Special, Super Users.

Actions — what group can do: Create, Edit, Edit Own, Edit State, Delete.

Creating Custom Groups

Users → User groups → Add:

Parent: Registered
Title: Premium Member

Create access level: Users → Access levels → Add:

Title: Premium Content
Groups: Premium Member

Assign content access level "Premium Content" — visible only to premium members.

Component Permissions

Each component has own permissions. Global configuration → Permissions sets global rights. Component configuration → Permissions — overrides for specific component.

Example: editors edit only their category content:

Component com_content → Category "Blog" → Permissions:
  Group: Blog Editors
  Action: Create = Allow
  Action: Edit = Allow
  Action: Edit Own = Allow
  Action: Edit State = Deny  (no publish)

Programmatic Access Check

use Joomla\CMS\Factory;

$user = Factory::getApplication()->getIdentity();

// Check if authorized
if ($user->guest) {
    // Show login form
    echo Factory::getApplication()->getDocument()
        ->getRenderer('component')
        ->render('com_users.login');
}

// Check access to specific level
if (!$user->authorise('core.view', 'com_content.article.' . $article->id)) {
    throw new \Joomla\CMS\Exception\ExceptionHandler(403);
}

// Check permission
if ($user->authorise('core.create', 'com_content')) {
    // show create button
}

// Check group membership
$groups = $user->groups; // array of group IDs
$isPremium = in_array($premiumGroupId, $groups);

Limiting Access to Menu and Modules

Each menu item and module has Access level parameter. Set "Premium Content" — item/module hidden for everyone except premium users.

Payment System Integration

For paid content — assign user to group after payment:

// After payment confirmation
use Joomla\CMS\User\UserHelper;

$user = \Joomla\CMS\Factory::getUser($userId);
$premiumGroupId = 8; // ID of Premium Member group

// Add to group
$groups = $user->groups;
$groups[$premiumGroupId] = $premiumGroupId;
UserHelper::setUserGroups($userId, $groups);

Multi-Level Subscription

Multiple access levels:

Basic Member → sees Basic Content
Pro Member → sees Basic Content + Pro Content
Enterprise Member → sees everything

Implemented via three groups with inheritance or three independent access levels assigned to needed content.

Timeline

ACL setup with 3–5 custom groups and access levels for paid content — 1–2 days.