How to use a set of global and per subsite permissions in a multisite installation?

Question

Use case:
I have a multisite installation in which I want to define a global configuration to be available to all subsites. I define this configuration in the default site. For this example let's say that is:

• a role editor
• a content type Article
• a content type Page

Now..

1. In all subsites that role editor need to have the permission "Use the toolbar". A global permission.
2. In subsite-a, I want to allow the editor to only add nodes of type Article
3. In subsite-b, I want to allow the editor to only add nodes of type Page

To add to that, let's say in the future I need to add a permission to the global set, I want to be able to import that set of permissions to all subsites without overriding any individual subsite permissions.

Currently I am using config_split and added user.role.editor.yml to the conditional section but I can't seem to make it work with the scenario described above.

Question:
How to maintain a global set of permissions and per site set of permissions without the global config overriding the config of the subsite? They need to rather extend each other so to say.

Any suggestions/help?

Answer 1

For now I solved this by creating a seperate global role which stays in the default shared config. I added the editor role to the conditional (graylist) section (configured per subsite) using config_split. So that way I am able to have seperate permissions for that role.

That global role can be automatically assigned to a subsite user during a new subsite install via a bash script/drush command for example.