Answers.Body: <p>It sounds like what you want is CiviCRM multi-site capabilities with the <a href="https://github.com/eileenmcnaughton/org.civicrm.multisite" rel="nofollow noreferrer">multisite extension</a>.  This will give you most of what you want without ACLs, and integrates well with Domain Access.  I've also <a href="https://civicrm.org/extensions/domain-access-civicrm" rel="nofollow noreferrer">written an extension</a> to properly handle creating new user logins via CiviCRM profiles with Domain Access.</p>
  
  <p>To handle the "propagate some groups to all users" scenario - with multisite, every subdomain will have a "master group".  Any contact in that group will be visible to all contacts on that subdomain.  If you set a master group as the parent of another group, all those contacts become visible to those domain members.  Since a group can have multiple parents, simply make the "visible to all" contacts have all the master groups as parent groups.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2018-03-12T17:22:28.353Z
Answers.Text: If you have more detailed questions, find me on https://chat.civicrm.org as @junglebird.
Answers.UserDisplayName: Jon G - Megaphone Tech
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2018-03-12T17:22:09.600Z
Answers.LastActivityDate: 2018-03-12T17:22:09.600Z
Answers.UserDisplayName: Jon G - Megaphone Tech
Body: <p>I have CIVICRM Drupal 7 install with several sub-domains. It's working fine until I have tried to control access to contacts based on the subdomain/drupal users and their roles.</p>
  
  <p>I have tried following the guide from the CIVICRM documentation <a href="https://docs.civicrm.org/user/en/latest/initial-set-up/permissions-and-access-control/" rel="nofollow noreferrer">here</a> </p>
  
  <p>However, I am finding it a little confusing as it appears to refer to both ACL "users" and "roles" and CMS "users" and "roles" interchangeably though they clearly are not. </p>
  
  <p>I am trying to achieve more-or-less the exact example case given on the page:</p>
  
  <blockquote>
    <p>A charity based in Chicago has three regional offices, and needs to give its fundraising staff the ability to create and edit contact records for prospective donors. They have decided that the fundraising department in each office can only have access to its local contacts. While the permission add contacts can be granted to authenticated users in the CMS (Drupal, Joomla! or WordPress), if view all contacts and edit all contacts were also assigned in this way, there would be no way to differentiate between the three groups of donors (locations). This could only be achieved with a CiviCRM ACL</p>
  </blockquote>
  
  <p>I would like to also have certain groups of contacts - created by specific drupal roles - also propagate to all users. </p>
  
  <p>The article explains in some detail how to create CIVICRM groups anf ACL roles but not how to link them to Drupal roles or the domain of origin of a contact. </p>
  
  <p>How would I do this, or is there a reasonable guide to achieving such a setup? </p>
  
Tags: <drupal><acl>
Title: Domain Access and CIVICRM ACL of data and drupal
ThreadText: # Domain Access and CIVICRM ACL of data and drupal
  
  (Asked by: username_0 on 2018-03-12)
  
  I have CIVICRM Drupal 7 install with several sub-domains. It's working fine until I have tried to control access to contacts based on the subdomain/drupal users and their roles.
  
  I have tried following the guide from the CIVICRM documentation [here](https://docs.civicrm.org/user/en/latest/initial-set-up/permissions-and-access-control/)
  
  However, I am finding it a little confusing as it appears to refer to both ACL "users" and "roles" and CMS "users" and "roles" interchangeably though they clearly are not.
  
  I am trying to achieve more-or-less the exact example case given on the page:
  
  > A charity based in Chicago has three regional offices, and needs to give its fundraising staff the ability to create and edit contact records for prospective donors. They have decided that the fundraising department in each office can only have access to its local contacts. While the permission add contacts can be granted to authenticated users in the CMS (Drupal, Joomla! or WordPress), if view all contacts and edit all contacts were also assigned in this way, there would be no way to differentiate between the three groups of donors (locations). This could only be achieved with a CiviCRM ACL
  
  I would like to also have certain groups of contacts - created by specific drupal roles - also propagate to all users.
  
  The article explains in some detail how to create CIVICRM groups anf ACL roles but not how to link them to Drupal roles or the domain of origin of a contact.
  
  How would I do this, or is there a reasonable guide to achieving such a setup?
  
  **Tags:** drupal, acl
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2018-03-12. Score: 2 | Accepted answer
  
  It sounds like what you want is CiviCRM multi-site capabilities with the [multisite extension](https://github.com/eileenmcnaughton/org.civicrm.multisite). This will give you most of what you want without ACLs, and integrates well with Domain Access. I've also [written an extension](https://civicrm.org/extensions/domain-access-civicrm) to properly handle creating new user logins via CiviCRM profiles with Domain Access.
  
  To handle the "propagate some groups to all users" scenario - with multisite, every subdomain will have a "master group". Any contact in that group will be visible to all contacts on that subdomain. If you set a master group as the parent of another group, all those contacts become visible to those domain members. Since a group can have multiple parents, simply make the "visible to all" contacts have all the master groups as parent groups.
  
  > **Comments:**
  > **username_1**: If you have more detailed questions, find me on https://chat.civicrm.org as @junglebird.  
  
  ---
  
  