I have CIVICRM Drupal 7 install with several sub-domains. It's working fine until I have tried to control access to contacts based on the subdomain/drupal users and their roles.
I have tried following the guide from the CIVICRM documentation here
However, I am finding it a little confusing as it appears to refer to both ACL "users" and "roles" and CMS "users" and "roles" interchangeably though they clearly are not.
I am trying to achieve more-or-less the exact example case given on the page:
A charity based in Chicago has three regional offices, and needs to give its fundraising staff the ability to create and edit contact records for prospective donors. They have decided that the fundraising department in each office can only have access to its local contacts. While the permission add contacts can be granted to authenticated users in the CMS (Drupal, Joomla! or WordPress), if view all contacts and edit all contacts were also assigned in this way, there would be no way to differentiate between the three groups of donors (locations). This could only be achieved with a CiviCRM ACL
I would like to also have certain groups of contacts - created by specific drupal roles - also propagate to all users.
The article explains in some detail how to create CIVICRM groups anf ACL roles but not how to link them to Drupal roles or the domain of origin of a contact.
How would I do this, or is there a reasonable guide to achieving such a setup?