The changelog for 2.2.2 says:
Fixed a bug where groups in an MSM site that didn’t have CP access to the main site couldn’t login to the CP of any other sites.
This is not true in my case. Switching off control panel access on the main site for users who should only have access to the secondary site prevents them from logging in at all. I’m using the masked CP and not providing CP access via the second domain at all. All logins go through my primary domain.
I’d appreciate any suggestions as I’d really like to use this feature. Some of the people who use the secondary site seem to have a hard time grasping the concept of switching sites via ‘the little button in the upper right hand corner.’