We have an upcoming multi-site project, in which our client would like us to implement a "restricted" SSO wherein the users of mainsite.com that have been given access to employees.mainsite.com will only have to log into one of the two sites to be logged into both. Note that all users must first become members of mainsite.com before they can be given access to employees.mainsite.com.
Most of the SSO has been worked out, and I am planning to use the same domain for users of both sites. Since all users would be created on mainsite.com first, I would simply use a security Role on the
employees domain to allow access to the employees.mainsite.com.
I know that I can assign roles from different domains to a user, but are there any negatives of doing this? Also, if a user with a given role is meant to have access to a site with a different security domain, are there any special security or configuration concerns that I should be aware of?