i am building a site whose primary purpose will be to manage customized
child sites. the goal is similar to what the folks over at http://bryght.com are
doing, but requires some customized features.
the child sites will share a common user pool and also some pre-configured
roles. right now each child site will have something like this in settings.php:
$db_prefix = array(
'default' => '',
'users' => 'masterdb.',
'profile_fields' => 'masterdb.',
'profile_values' => 'masterdb.',
'role' => 'masterdb.'
);
(educated comments on above strategy welcome)
i've got two custom roles that all sites will share, 'global admin' and 'domain
admin'. 'global admin' is equiv to super-user and will have all access to all
sites. 'domain admin' will be the 'owner' of a child site and will have access
only to admin options for a single child site (domain).
furthermore, users may be registered to one or more child sites. they will be
allowed "authenticated user" access only to sites they are registered to.
so i have two goals here:
1: prevent 'domain admins' from accessing user info for users that are
not registered within their domain. at this point, it looks like i'll be
using an external table that maps users to domains they are registered to
(call it the subscriptions table). so to restrict admin access to users,