Unable to fully protect subdomains?

Bump...really could do with some help here. Many thanks.

Hi, thanks very much for your post. I don't think I'm explaining myself very well.

I have set up various user names with domain permissions to access different combinations of domain and subdomain:

testone - access to domain test.local and test1.test.local
testtwo - access to domain test.local and test2.test.local
testonetwo - access to domain test.local, test1.test.local and test2.test.local

This has been done in the users list/add page where the module has added an extra column 'domains'. I have ticked access to the domains as listed above.

What I'm looking to achieve is for a user who has been given access to, say test.local (the domain) and test1.test.local (one of the subdomains) to be able to login to each of these domains but if they try to login to test2.test.local (which they have not been given permission to access) they will not be able to log in.

Also, I'm looking to allow someone, say 'test one', to loginto test.local and then to traverse to test1.test.local but get booted out of any other sub domain they try to access, say test2.test.local.

Using bonus login restrict:

What I am finding is that if the $cookie_domain is set is that users are able to traverse to subdomains that they don't have permission to access (for example, someone who has only been given access to the domain and also test1.test.local can actually get access to test2.test.local just by typing in the URL in the address bar).

With the $cookie_domain commented, users are not able to traverse to the subdomains that they have permission to access without logging in again to each domain.

If I switch modules and de-activate bonus login and use login strict:

What I am finding is that if with the $cookie_domain commented out, users who have no permission to access a particular sub domain can login to that sub domain (for example testone user can login to the test2.test.local sub domain) which I do not think that they should be able to do. Also, as the cookie domain is not set users cannot traverse the domains in the way that I want.
If I set the $cookie_domain then users may traverse the domains but I have no way of kicking out those users who have not been given permission to access a particular sub-domain, (when they change sub-domains), or of stopping them from successfully logging into sub domains that they haven't been given permission to login to.

Domain access and associated modules appear to do exactly what I am looking to do from a content perspective but I cannot seem to find a way to balance the login to be restricted to only those sub-domains that they have been given permission with the ability to traverse those sub domains that they have got permission to view (and thereby making them login all the time).

If you can help save the last of my hair from being torn out I would be really grateful.

As a final note, I have thought that it might be worth looking into using LDAP as an external authentication source but if I can save myself the bother of setting this up and use these modules then that would be great!

Thanks again for your time,
Crom

Bump...sorry for hassling but I'm not getting very far here ;-)

Thanks for any help.

I've tried to code up a module that does what I am looking for. Namely, allowing the $cookie_domain to be set so that users may traverse the sub domains but if a sub domain is visited that the user is not assigned to then they get booted out.

The code borrows heavily from agentrickard's work on the domain access module and I'm sure that the code can be improved upon as I'm not hugely PHP or module-programming literate but I thought I'd publish it here in case it's of use to anyone and perhaps people would like to comment on improvements or how I might achieve the same result without going to these lengths.

One question I have is that currently the module is a simple block module and I'd rather it wasn't but I can't find a user hook to use as when a user traverses between sub domains with the $cookie_domain set they are not logging in and no user hook appears to be called. If anyone with more experience of the drupal API can point me to a way to trigger this module without it being a block it would be very helpful.

dc.info

; $Id$
name = domain booter
description = boot users out of a domain that they don't have access to but are allowed to traverse to the sub-domain because the cookie is set in settings.php
core = 6.x
package = Domain Access

dependencies[] = domain

dc.module

// $Id: dc module Exp $
global $moduleName;
$moduleName = "dc";

/**
* Implementation of hook_block().
* @param string $op one of "list", "view", "save" and "configure"
* @param integer $delta code to identify the block
* @param array $edit only for "save" operation
*/
function dc_block($op = 'list', $delta = 0) {

 // set up the block 
  $block = array();

  if ($op == "list") {
    // Generate listing of blocks from this module, for the admin/block page

    $block[0]['info'] = t('Sub domain access controller');
  }
  else if ($op == 'view') {

    // Generate our block content

    // Fill in the subject of our block which is the same whether or not
    // the block has any real content
    $block['subject'] = 'Sub domain access controller';
    global $user;
     global $account;
     $account = user_load(array('uid' => $user->uid));
     $current_user = $user->uid;
     
     if ($current_user == 0 ) { //if the current user is not logged in then let normal security takeover
      	return 0;      
     }
     
     //get current domain and write it out for bugchecking
     $current_domain_array = domain_resolve_host(); 
     if (!empty($current_domain_array)) {
   	    		$current_domain = $current_domain_array['domain_id'];
     } else {
	  		$block['content'] = $block['content'] . 'no current domain ';
     }
		
     //get list of currently authorised domain names
     $auth_domains= domain_get_user_domains($account);
     if (!empty($auth_domains)) {
   			foreach ($auth_domains as $key => $id) {
        //only used for debug writing to screen	
      	} 
   	 } else {
      	$block['content'] = $block['content'] . 'domain empty ';
   	 } 
     
    //Check for match of current domain and superadmin or root domain check - all auth'd people may see root domain
   	if ((isset($auth_domains[$current_domain])) || ($current_user == 1) || ($current_domain == 0 )) { 
    		return 0;
    } else {
    	// no match found but check that current domain is not root and user is not superadmin
    	if (($current_domain != 0 ) && ($current_user != 1)) { 
	  redirect_user();
    	}
    }
  }

  return $block;
} // function dc_block


function redirect_user($msg = 'default') {
  global $_domain;
  $default = domain_default();
  
    if ($msg == 'default') {
      drupal_set_message(t('You have been redirected as you have no authority on this domain'));
    }
    else if (!empty($msg)) {
      drupal_set_message($msg);
    }
    domain_goto($default);
  
}

Hi ajmartin,

I coded up the module and submitted it (which you can see here: http://drupal.org/node/955712). Unfortunately, I ran out of time on this and didn't complete the changes required for the module to be accepted.

However, from the comments, it looks like the changes are relatively minor so you're more than welcome to try it out and even make the changes yourself.

I will return to it when I have time and a use case for it.

Cheers,
Crom