Display users created only by the current user in Admin/People

Question

Below is the site's user access level hiearchy:

There is a user myid_administrator which has a role MYID ORGANIZATION ADMINISTRATOR. The administrator, aegono, had enabled 'Administer users' to enable the user myid_administrator, create users.

In the url admin/people. myid_administrator can see users which has a higher level of user access than it. For example, It can see 'aegono', the administrator of the site.

I want it to display only the users , the myid_administrator created and below its user level. Is it possible ? How? Do I have to create a customized form for the users with roles MYID ORGANIZATION ADMINISTRATOR, to add users and only see the users it created? Or is there any module than can help my problem?

Answer 1

Are you aware of the Subuser module? It appears to be capable of doing exactly what you want.

This module allows users to be given the permission to create subusers. The subusers may then be automatically assigned a role or roles. The parent of the subusers then has the ability to manager the users they have created.

Answer 2

Have you try User Create By module? The features looks promising:

• Saves uid of user who creates other users. And if user registers then anonymous users uid is saved which is 0.
• User Created By module provides view handler which allows to make relationship in view and add user creator's name or other corresponding fields of user creator in view.

Here you go https://www.drupal.org/project/user_created_by

Answer 3

You can hide the administrator role (and its users) for users with not sufficient permissions by doing this:

1) I would suggest you to install the admin views module, in case you haven't done already and override the admin/people page.

2) Implement the following hooks: hook_form_alter and hook_views_query_alter

 /**
  * Implements hook_form_alter().
  */
function my_module_form_alter(&$form, &$form_state, $form_id) {
  global $user;

  // Hide the 'administrator' user role filter option.
  if ($form_id == 'views_form_custom_view_name_system_1' && !_allowed_roles($user)) {
    $role = user_role_load_by_name('administrator');
    unset($form['rid']['#options'][$role->rid]);
  }
}

// Return if the logged in user can view the administrator role.
function _allowed_roles($user) {
  return in_array('Role 1', $user->roles) || in_array('Role 2', $user->roles);
}


/**
 * Implements hook_views_query_alter().
 */
function my_module_views_query_alter(&$view, &$query) {
  global $user;

  if ($view->name == 'custom_view_name' && !_allowed_roles($user)) {
    $role = user_role_load_by_name('administrator');

    $join = new views_join();
    $join->table = 'users_roles';
    $join->field = 'uid';
    $join->left_table = 'users';
    $join->left_field = 'uid';
    $join->type = 'INNER';
    $join->adjusted = TRUE;

    $query->add_relationship('users_roles', $join, 'uid');
    // Hide the 'administrator' role users from the actual users' list.
    $query->where[] = create_views_where_expression($field = 'users_roles.rid', $value = $role->rid, $operator = '<>');
  }
}

3) Don't forget to add to the (above) users overridden view the User: Roles (exposed) filter.

So far we have the administrator role hidden from the users list, let's now restrict the access (edit) to the actual accounts as well.

4) Again, we implement some hooks and an access callback function: - hook_permission, it let us to define user permissions (UI) - hook_menu_alter allows us to alter the default callback function and _admin_edit_callback the custom callback to implement our logic.

/**
 * Implements hook_permission().
 */
function my_module_permission() {
  return array(
    'edit administrator profile' =>  array(
      'title' => t('Edit administrators profiles'),
      'description' => t('Perform changes to administrators accounts'),
    ),
  );
}

/**
 * Implements hook_menu_alter().
 */
function my_module_menu_alter(&$items) {
  $items['user/%user/edit']['access callback'] = '_admin_edit_callback';
  $items['user/%user/edit']['access arguments'] = array(0, 1, 'edit');
}


/**
 * Access callback for admin user edit operations
 * @param $type
 *  The entity type.
 * @param $entity
 *  The entity object.
 * @param $op
 *  The operation to the entity.
 *
 * @return bool
 */
function _admin_edit_callback($type = NULL, $entity = NULL, $op = NULL) {
  global $user;
  $account = user_load($user->uid);

  // Selected users with full access.
  if (_allowed_roles($user)) {
    return user_edit_access($account);
  }
  else {
    // Check users access.
    if ($op === 'edit') {
      if ((user_access('edit administrator profile', $account) || $user->uid == $entity->uid) && $account->uid > 0) {
        return TRUE;
      }
      else {
        return FALSE;
      }
    }
  }
}

Apparently this is a custom way to resolve your issue, not a module, but taking advantage of the Drupal's API will benefit you more in the future, happy coding!

Answer 4

Subuser module should fulfill your requirement, but according to your screenshot the administrator user can watch all users because for admin there is a default global user variable there. Uncheck that user subuser module and you will get the permission for the subuser, then you can manage their access.