Access from different Network, one allow admin roles the other not

Question

I have a Drupal 7 site on a server wich can be accessed by 2 differents Network (A and B). On both Network I use SAML to authentificate the users and affect them their roles (including back office roles) with SAML attributes. When an user logs in from network A to my site he must have his back office options but when he logs in from network B he must not have them.

I want to block any administration feature, not just back office access so blocking urls will not be enough. I don't want to see the edit/view tabs on content in the front office. I don't want them to have access to content that is not published (even if they have access to it on network A). Like the users had no back office role at all when they are on network B.

I am able to detect wich network the user is using on each visit and I have some code that allows me to affect the back office roles only if he comes from network A.

But if the user logs in first on network A then on his mobile access the site from network B and logs in he will lose his back office role on A unless he logout/login again.

Is there a way to disable all back office (admin) features on each visit if coming from network B? And not on each login? Aka a solution not involving removing his back office roles so he keep them when on network A.

Answer 1

Ok so the best solution I found wich might even work with a cache engine and without altering core was to remove the roles from the global $user in a hook_boot() :

function myModule_boot() {
  global $user;

  // if the user is connected and I am on network B
  if ($user->uid != 0 && variable_get('networkB', FALSE)) {
    // then we remove the role BO from the global $user
    // wich are stocked in a variable (roles_back_office) as a string (rid separated by pipes).
    foreach(explode('|', variable_get('roles_back_office')) as $rid) {
      if (isset($user->roles[$rid])) unset($user->roles[$rid]);
    }
  }
}