Our website needs to allow staff (staff role) and editors (editor role) to be able to edit the accounts and roles of authenticated users and all other users with roles less privileged than their own role, without being able to edit the accounts and privileges of users of a higher privilege level.
Here is an example of hierarchy of our user roles:
- admin (super-user, developer only)
- editor (organization's admin and non-development high-level user, many privs)
- staff (organization's staff users, some special privs)
- member (user with special access privs)
- authenticated user (regular user)
Currently, if I allow users to edit user accounts and assign roles, they are able to not only assign themselves to top-level administrator account, but also de-assign the administrators and change their passwords, etc.
This post asks a similar/related question which is slightly different but also does not have an answer. I assumed the Drupal Core had a built-in functionality that allows for this by considering the order of roles, so I am wondering if I did something wrong.