multisite module - question about its current use

[Chris Burgess]

Hi, am exploring the CiviCRM Multisite module (SVN from http://svn.civicrm.org/tools/trunk/drupal/modules/multisite/ plus patch from http://issues.civicrm.org/jira/browse/CRM-5418). I have a question about how it's being used currently.

I've done ACL restrictions based on the current logged-in user's contact ID, but I see that in the multisite module you're simply using the group ID to apply restrictions. Does this indicate that for PIRG, you are preventing users from one multisite install from even logging into another multisite install?

If so: what method are you using for sites running multisite.module? Separated users tables? Validation in hook_user()? Something else?

Without that, it seems like users from SiteB would be able to access contacts and custom data from SiteC simply by logging into SiteC using their SiteB creds.