Separate permissions for administering user configuration and administering users

Question

In Drupal 7 there is one permission for administering users, "Administer users".

This covers both the main user management page at 'admin/people/permissions', and the configuration of settings/fields for the user entity at 'admin/config/people/accounts' and 'admin/config/people/accounts/fields'.

A very common requirement for a site that's being released to a client is that they can administer the users (fair enough right?), so they need the "Administer users" permissions.

However, granting that permission also gives them access to edit the user entity settings/fields, which is very undesirable (no client should be able to change the underlying structure of the user once it's been set up, for obvious reasons).

This must be something a lot of people have to deal with...what methods/modules/custom code do people use to get around this limitation in the user module?

Answer 1

One method is to create a new permission

function MYMODULE_permission() {
  return array(
    'administer user configuration' => array(
      'title' => t('Administer User Configuration')
    )
  );
}

and then re-assign the pages under 'admin/config/people' to that permission:

function MYMODULE_menu_alter(&$items) {
  foreach ($items as $path => &$item) {
    if (strpos($path, 'admin/config/people') === 0) {
      $item['access callback'] = 'user_access';
      $item['access arguments'] = array('administer user configuration');
    }
  }
}

Then the user role in question can have the 'Administer users' permission, but not have access to the admin/people/config pages.

This feels messy at best though.

Answer 2

I do this by altering the access arguments of a menu item.

function MODULENAME_menu_alter(&$items) {
    // Accounts filter
    $items['admin/config/people/accounts/fields']['access arguments'] = array('custom user permission');
    $items['admin/config/people/accounts/display']['access arguments'] = array('custom user permission');

}

/**
 * Implements hook_permission().
 */
function MODULENAME_permission() {
   return array(
    'custom user permission' => array(
      'title' => t('Custom user account permission'), 
      'description' => t('Customized users permission @see MODULENAME.module'),
    ),
  );
}