[dev] What is the best way to separate virtual domains with horde?

[Edwin L. Culp]

I would like to be able to keep interaction between virtual domains 
minimal.  I have changed my ldap base tree structure from ou=people, 
o=basedomain.org to ou=organizationDomain.tld,o=basedomain.org and have 
reduced issues with seeing users from all domains when setting 
permissions, for example, but with permissions set to all authenticated 
users apps such as whups, ansel, kronolith are still, more or less 
shared.  I try to set everything up by using a domain name that is 
unique by definition and their email user at organization.org, also unique 
and can/should be used for internal private and shared secure 
communication as well as public.  The end result that I am looking for 
could possibly be just another permission setting like "All users from 
[ Domain list dropdown ].  I don't understand the permissions in Horde 
so I don't know if that would be practical or even work.

I'm sure others have seen this and solved it in their own way.  I could 
very well be drowning in a glass of water ;-)  I'd be very interested 
in knowing what your ideas are or what you have done to keep virtual 
domains independent.


I have considered:

  1. Multiple horde installations w/multiple mysql databases.
     Each with a different vfs path, probably.
  2. Single horde installation w/multiple mysql databases
     Each with a different vfs path configured dynamically
     using $_SERVER['HTTP_HOST']
  3. Modification of the permissions system (No idea about this.)

Thanks,

ed