Domain Access and CIVICRM ACL of data and drupal

Question

I have CIVICRM Drupal 7 install with several sub-domains. It's working fine until I have tried to control access to contacts based on the subdomain/drupal users and their roles.

I have tried following the guide from the CIVICRM documentation here

However, I am finding it a little confusing as it appears to refer to both ACL "users" and "roles" and CMS "users" and "roles" interchangeably though they clearly are not.

I am trying to achieve more-or-less the exact example case given on the page:

A charity based in Chicago has three regional offices, and needs to give its fundraising staff the ability to create and edit contact records for prospective donors. They have decided that the fundraising department in each office can only have access to its local contacts. While the permission add contacts can be granted to authenticated users in the CMS (Drupal, Joomla! or WordPress), if view all contacts and edit all contacts were also assigned in this way, there would be no way to differentiate between the three groups of donors (locations). This could only be achieved with a CiviCRM ACL

I would like to also have certain groups of contacts - created by specific drupal roles - also propagate to all users.

The article explains in some detail how to create CIVICRM groups anf ACL roles but not how to link them to Drupal roles or the domain of origin of a contact.

How would I do this, or is there a reasonable guide to achieving such a setup?

Answer 1

It sounds like what you want is CiviCRM multi-site capabilities with the multisite extension. This will give you most of what you want without ACLs, and integrates well with Domain Access. I've also written an extension to properly handle creating new user logins via CiviCRM profiles with Domain Access.

To handle the "propagate some groups to all users" scenario - with multisite, every subdomain will have a "master group". Any contact in that group will be visible to all contacts on that subdomain. If you set a master group as the parent of another group, all those contacts become visible to those domain members. Since a group can have multiple parents, simply make the "visible to all" contacts have all the master groups as parent groups.