User's to edit roles and permissions for any user less privileged

Question

Our website needs to allow staff (staff role) and editors (editor role) to be able to edit the accounts and roles of authenticated users and all other users with roles less privileged than their own role, without being able to edit the accounts and privileges of users of a higher privilege level.

Here is an example of hierarchy of our user roles:

• admin (super-user, developer only)
• editor (organization's admin and non-development high-level user, many privs)
• staff (organization's staff users, some special privs)
• member (user with special access privs)
• authenticated user (regular user)

Currently, if I allow users to edit user accounts and assign roles, they are able to not only assign themselves to top-level administrator account, but also de-assign the administrators and change their passwords, etc.

This post asks a similar/related question which is slightly different but also does not have an answer. I assumed the Drupal Core had a built-in functionality that allows for this by considering the order of roles, so I am wondering if I did something wrong.

Answer 1

Drupal core doesn't have any out of the box functionality to manage roles and permissions in a hierarchical manner.

However, there are a couple modules that provide extra permissions which might be helpful in what your trying to achieve.

1. Role Delegation gives you a new set of permissions which are very fine-grained. From the module page-

   For each role, Role Delegation provides a new assign ROLE role permission to allow the assignment of that role.

2. Administer Users by Role. From the module page-

   This module allows site builders to set up fine-grained permissions for allowing "sub-admin" users to edit and delete other users — more specific than Drupal Core's all-or-nothing 'administer users' permission. It also provides and enforces a 'create users' permission.

   From the readme of the module-

   NEW PERMISSIONS

   Access the users overview page See the list of users at admin/people. Only users that can be edited are shown.

   Create new users Create users, at admin/people/create.

   Edit users with no custom roles Allows editing of any authenticated user that has no custom roles set.

   Edit users with role XXX Allows editing of any authenticated user with the specified role. To edit a user with multiple roles, the sub-admin must have permission to edit ALL of those roles. ("Edit users with no custom roles" is NOT needed.)

   The permission for cancel work exactly the same as those for edit.

   (1) should give what you need but still including (2) which might have a new permission that you wouldn't want to miss out on.