We have an Organisation with cca. 400 local branches and have trying to achieve a following ACL behaviour:
-- Organisation members needs to be able to login and have access to their Organisation members records only.
-- Organisation admins may administer all members in their Organisations and Organisation itself (and in theory could be administering more than one Organisation thus more members).
-- Organisation admins need some kind of dashboard which gives them access to their own societies.
-- Main civiCRM admin(s) need to be able to assign ACLs to a user
We have Relationships in place, so each Organisation has it's members listed in Relationships tab in civiCRM. Now, this is a workaround which seems has to be done:
1. civiCRM side
1.1. Create Group (AccessControl) for each Organisation
1.2. Create Group (AccessControl) for each Organisation Admin Users (NB! SmartGroups wi not work since there is no AcessControl for them, there is a thread from 2007 regarding this: http://forum.civicrm.org/index.php?topic=1645.0)
1.3. Create ACL Role for each Organisation Admin
1.4. Assign each ACL Role to corresponded Organisation Admin Group
1.5. Create ACL for each Organisation where Role = Soiety Admin Role and operation = Edit and Type of Data = Group of Contacts and Group = corresponded Organisation Group
2.1. Create Role for each Organisation Admin
2.2 Grant access:
CiviCRM: profile listings and forms
CiviCRM: profile listings
CiviCRM: access CiviCRM
CiviCRM: access Contact Dashboard
2.3. Create/move DrupalUsers based on Civi Contacts we'd want to be admins and assign each of them to own Role
2.4 Use "CiviMember Roles Sync" http://wiki.civicrm.org/confluence/display/CRMDOC/CiviMember+Roles+Sync to sync Drupal Roles with Civi Groups
We've studied some related threads:
"Multi-level Organization ACL Permissions" Multi-level Organization ACL Permissions ( where multi-site workaround suggested sounds even more overhelming than current approach,since we have 380+ organisations and all Contacts data currently stored in single CiviCRM database ). Have tried also "local permissions extension we built for the National Democratic Institute" hoping that it would be possible to convert geografic-centered approach to Organisations-centered; may be it's a way to go, although it needs deep code diving.
"Allowing group management to users with limited permissions" Allowing group management to users with limited permissions from where we've found out that " users can only view the groups for which they explicitly have an ACL for. " which doubles all work, since now we need a pair (Admins and Members) of Role,ACL,Group for each Organisation.
Yet another option found has been a "Related Permissions Module" extention from nz.co.fuzion ( http://github.com/eileenmcnaughton/nz.co.relatedpermissions/zipball/master ) suggested among related threads at stackexchange or forum.civicrm.org, however it doesn't seems to be compatible with most recent version of civicrm. This one sounds like a best "theoretical" approach so far since it tends to use component (Relations) which have been already installed and configured. However it's hard to find out from here if it worth investment of development hours to make it work since it's hard to say if it was working the way we need.
Afraid, not all related links from all sources are listed here (like related pages from book.civicrm.org or wiki.civicrm.org), we've studied a lot.
So, any fresh advice will be highly appreciated; can't believe CRM might have such,well, let's call it "complex" permissioning system.