Give permission to manage users but not permissions

Question

We have setup a site in Drupal 7 on which we would like certain users to have access to the user management page, and be able to create new users, assign roles, etc., but we don't want to give them access to the Roles and Permission pages.

Currently Drupal only has 2 permissions Administer Permissions and Administer users.

With the Administer users permission, the user has access to the User Management page, and can create new users but cannot assign roles to users.

If the user has the Administer permissions permission, he can assign roles to users and also access to the permission and role management pages.

How would you grant a user the right to assign roles to users, but prevent him from accessing the permission page?

Answer 1

I had the exact same requirement, and I was able to use the Roles Delegation module to build it to perfection :-)

Here is my scenario to give you more context -

1. I had a drupal site with roles - A, B, C, Admin, Maint
2. I wanted users with role Maint to be able to create new users and also assign them roles while doing so
3. I also wanted to limit Maint users to be able to assign only roles A, B, C to the new users and not the role Admin
4. All of it was just a few clicks with the Roles Delegation module

Hope this helps.

Answer 2

Hmmm... Interesting that there does not seem to be a clear cut way to do this. This seems like it could be a common feature for people. I found a couple solutions:

http://drupal.org/project/protect_permissions - However, this is not yet ready for production use.

However, I think you can accomplish what you want with: http://drupal.org/project/permissions_lock

You will also need: http://drupal.org/project/user_permissions

The later seems to do the opposite of what you want but the former seems to do exactly what you want. I have not tested either of these on my dev site to ensure 100% this is what will work for you. If I come across anything else I will update this answer.

Answer 3

Roles delegation leaves a security hole. You need to assign people the administer users for them to be able to use the administration page and the tools it has.

But if you do so, then that role will be able to edit even superadmin. Check Beware of Drupal's Administer users permission for a full description.

My solution is roles delegation + this hook

function hook_user_presave(&$edit, $account, $category) {
    if( $account->uid == 1 || in_array('adminrole',$account->roles)){ //trying to edit an admin
        global $user;
        if($user->uid != 1){//only super admin can do that
            drupal_set_message( "You attempted to edit an admin or dev user name and you are not allowed, this attempt was logged." ,'error');
            watchdog('permissions_extra','Logged in user %user tried to edit account %account', array('%user' => $user->uid, '%account' => $account->uid), WATCHDOG_ERROR);
            drupal_goto('/admin/people');
        }
    }
}

Answer 4

Lately we've been using the roleassign module, which does exactly what you're asking. It's fundamentally identical to the role_delegation module, but could be an alternative if you needed something slightly different.

One key difference is how you decide which roles are available to be assigned. With roleassign, you just select which ones you want to make available, and it only adds a single new permission to assign those roles:

The role_delegation module appears to give a new permission for each role that exists on the site:

The role_delegation module also seems to have nearly triple the number of installs, and a "recommended" Drupal 8 release. The issue queue also seems to be in better shape, so it's probably the better option?