I’ve recently started properly
battling playing with Orchard and came across a gotcha which may simply have been down to a misunderstanding on my part, but I didn’t find much info when searching for it so figured I’d blog about it myself.
Having set up an initial instance, I switched on the multi-tenancy module so as to install a second instance alongside the first one rather than deploying another copy of Orchard in its entirety. When attempting to install some additional modules within the second instance, I ran into trouble – every time I clicked the “Install” link for a module in the gallery, or the “Install a module from your computer” link within the “Installed” tab of the Modules section, I got an “Access denied” error.
I started checking permissions in various places – my Orchard user account, filesystem ACEs, IIS configuration etc. In the end I had to dive into the code to see what conditions were in use.
Turns out that the problem lay with the fact I was using multi-tenancy – module installation (and possibly themes too though I haven’t checked) is only possible from the default instance, not the other tenants. I’m assuming this is because all tenants share the same modules and themes, and only the default instance is allowed to control them to prevent anarchy breaking out amongst the different tenants. My solution was simple – install the module via the default instance and then go back to the second one where it immediately showed up for me to enable.
Whilst I can see some logic to the business rule here, and maybe it’s spelled out clearly somewhere I missed, I think it could be handled better – there either ought to be a delegation feature within the multi-tenancy module that grants tenants the right to install modules, or a clearer error message when access is denied that makes it immediately obvious what the problem is. At the very least the UI for installing a module ought to be hidden when logged in as a tenant to avoid confusion.
Note the above all applies to Orchard 1.2 – if you’re reading this blog post some time down the line, be aware that it may not apply any more.