Restrict Users from creating + editing higher level accounts, but still able to create + edit lower level accounts

Question

I'm trying to restrict the permissions of a custom user role so that they can create, edit and delete lower level accounts, but not have any access to create or edit Administrator accounts.

I've already tried Administer Users by Role and User Protect, but neither of these provide the functionality I need.

User protect allows me to lock down my Admin account, but a lower level user can still create an administrator account if they want. Administer Users By Role features an permission for 'Create new users', but no permission to restrict the level of user each role can create.

What I need is for a Sub-admin to be able to create and edit sub-admin accounts, but not create or edit Administrator accounts. Is there any way to achieve this?

Answer 1

I finally Discovered the Role Delegation module, which provides the exact functionality described above. Apparently Role Assign also does a similar trick.

Both, however, allow the assigning of multiple roles to a single user, rather than forcing a single role. This allows a user to apply multi-layered permissions to a single user.

If there's any way to force a single role choice, it would be perfect.

Update

I tweaked my copy of the Role Delegation module to show radio checkboxes instead of conventional checkboxes. It doesn't inherit settings like 'default role for new users', but it avoids this multi-user issue.

Answer 2

The Organic Groups module may do a little more than you are looking for but it does have this exact functionality.

It can be setup in such a way where users will be assigned to groups and the group admin role can administer other users of that group.

The only other way that I've actually achieved this without OG is with a custom module. You can write in your own permission and then do a form alter to hide certain users unless they have that permission. This way can be pretty clean and certainly less configuration than OG, but OG will be more flexible.