CiviCRM Community Forums (archive)

Not too sure which child category is the best place to post this.

Say I have multiple drupal/civicrm installations, 1 in each country.

All the countries have their own independent users and contacts of members in their own country.

Is it possible for 1 country's (this is the main HQ) admin users to access user data in all the other civicrm installation? Need not be admin access but can be through the Views module. The idea is that the main HQ needs to verify membership of users in the other countries.

The main HQ should not know the db passwords of the other countries but use some form of LDAP check to gain access.

Will the multi-site or domain access module be appropriate?

Of course, 1 way of doing this is for each country to create an account for the HQ admin user to login at the local site to check. But that will mean the HQ ends up having multiple user accounts to login, 1 for each country.

We plan to roll out civicrm in multiple countries to manage the membership in each country.

This is a real query that I got from the HQ.

I am also wondering in how this going to be for you.
I have a similair use case in which the Internatioal Office is managing a Civi database and and international website. They want their country offices also to use the same civi database (this is different from your situation) but want to to provide a website (template) for their country offices. So that each country has its own website provided by the international office with integration to the civi install.
This use case tend to use Wordpress for the website as it is easier develop a nice theme for and the website guy is a volunteer to the organisation.

I still haven't written our blog about the Extended Permissions option which allows you to do a permission tree based on relationships - meantime i wrote this not long ago on another thread

One approach is based on 'domain' and you give each sub organisation their own cms front end which you set up with a domain id in the database and hence someone from that cms only sees contacts created via - or deliberately added from the top level to - that cms (and hence having the relevant Domain ID)

The other approach we have worked on and 'like' is based around cascading permissioned relationships.

So if Person A is 'officer' for Branch A, then sees contacts with relationship to Branch A

If Person B is 'officer' for Region A, and if Region A has permission over Branches A1, A2, etc, then Person B has access to all contacts at level A

And up it goes ....

And there may be other approaches other than using the standard ACL Groups approach in core CiviCRM - such as building the ACL to work of the options of a Custom Field - eg Person A has 'A' ticked, Person B has 'B' ticked, and then Manager 'A' can see all 'A's etc

Perhaps if you spell your scenarios ie what makes Contact A have the rights to see Contact B but not Contact C we may be able to point you better to a good solution.