“Access denied” error when installing Orchard modules

By Luke Bennett | Published: July 22, 2011

I’ve recently started properly battling playing with Orchard and came across a gotcha which may simply have been down to a misunderstanding on my part, but I didn’t find much info when searching for it so figured I’d blog about it myself.

Having set up an initial instance, I switched on the multi-tenancy module so as to install a second instance alongside the first one rather than deploying another copy of Orchard in its entirety. When attempting to install some additional modules within the second instance, I ran into trouble – every time I clicked the “Install” link for a module in the gallery, or the “Install a module from your computer” link within the “Installed” tab of the Modules section, I got an “Access denied” error.

I started checking permissions in various places – my Orchard user account, filesystem ACEs, IIS configuration etc. In the end I had to dive into the code to see what conditions were in use.

Turns out that the problem lay with the fact I was using multi-tenancy – module installation (and possibly themes too though I haven’t checked) is only possible from the default instance, not the other tenants. I’m assuming this is because all tenants share the same modules and themes, and only the default instance is allowed to control them to prevent anarchy breaking out amongst the different tenants. My solution was simple – install the module via the default instance and then go back to the second one where it immediately showed up for me to enable.

Whilst I can see some logic to the business rule here, and maybe it’s spelled out clearly somewhere I missed, I think it could be handled better – there either ought to be a delegation feature within the multi-tenancy module that grants tenants the right to install modules, or a clearer error message when access is denied that makes it immediately obvious what the problem is. At the very least the UI for installing a module ought to be hidden when logged in as a tenant to avoid confusion.

Note the above all applies to Orchard 1.2 – if you’re reading this blog post some time down the line, be aware that it may not apply any more.

This entry was posted in Fixes and tagged , . Bookmark the permalink. Post a comment or leave a trackback: Trackback URL.

3 Comments

  1. Sonny
    Posted February 19, 2012 at 12:36 am | Permalink

    Thanks for the Post. I agree it needs to be fixed.

    Reply
  2. Harald Mühlhoff
    Posted November 28, 2013 at 4:47 pm | Permalink

    Problem still there in Orchard 1.72 … thanks for your post!

    Reply
  3. LesliE
    Posted October 19, 2020 at 12:53 pm | Permalink

    Thanks for your post, I ran into this issue today and have no idea what’s happening… 😀

    Reply

44 Trackbacks

Leave a Reply