It's the other way round - the superuser can log in to any portal, but then nothing works! From DMXService.asmx.vb line 489
UserInfo = UserController.ValidateUser(Credentials.PortalId, Credentials.Username, Credentials.Password, ...)
This succeeds. But then later on ...
If Not objUser Is Nothing _
AndAlso Not objUser.IsSuperUser _
AndAlso objUser.Membership.Approved = True _
AndAlso objUser.Membership.LockedOut = False Then
'everything is fine.
_portalId = Me.Credentials.PortalId
End If
It explicitly does not copy the portal ID from the passed in credentials if the superuser has logged in. _portaID remains with its initialized value - _portalId As Integer = -1
I think you probably intended to throw a security exception at this point - most of those checks are redundant, locked out and unapproved have already. Actually you could probably just quietly remove the line "AndAlso Not objUser.IsSuperUser" if you wanted and it would start working.
Anyway, the result is that any webservice call that uses the portalid is stuffed. As I said, in most cases that means 0 results returned from queries, for example GetEntry() effectively becomes..
select ... from dnn_DMX_Entries where portalID=-1 and entryID= @ENTRYID
.. which will never find anything.