Create role for changing user accounts and not admins

Question

I am developing a documentation site for a client. The site has the option of Who can register accounts? set to Visitors, but administrator approval is required.
So, currently only Admin(user1) is doing the user approval procedure.

Our client has a customer services team which handles this account approval procedure currently. So, if I create a new role (say moderator) and give it permission to administer users (blocking/unblocking, changing role of a particular user), then they will also be able to modify admin users' account; and this is not expected.

Is there a way(any module or either) to restrict moderators to administer only few roles and not admins' role? Is there any other way to do this?

I am looking something similar to this sandbox project, but I want different set of permissions.

Answer 1

As far as I can see, the accepted workaround is not secure. It would not prevent editing the administrator account via direct URL such as user/2/edit.

Maybe try the User Protect module:

This module allows fine-grained access control of user administrators, by providing various editing protection for users. The protections can be specific to a user, or applied to all users in a role.

Answer 2

This module might be what your looking for. http://drupal.org/project/administerusersbyrole

With it you will get permissions for any role to change any other role. Here is a screen shot of it in action on the permissions page.

Answer 3

There is role_delegation stable for D7.

This module allows site administrators to grant some roles the authority to assign selected roles to users, without them needing the administer permissions permission.

Answer 4

Work around:
I created a new role Manager who will manage the user administration (approval of the pending users who are blocked, depending of their criteria).

I gave "Administer users" permission to this role. And in admin/people used a hook_form_alter to hide the list of users with administer users permissions.

function MODULE_form_alter(&$form, &$form_state, $form_id) {
    if ($form_id == 'user_admin_account') {
        global $user;

        if(!in_array('administrator', $user->roles)) {          
            $result = db_query("select uid from {users_roles} where rid=3"); //rid=3 for administrators

            foreach($result as $temp) {
                unset($form['accounts']['#options'][$temp->uid]);
            }
        }   
    }   
}

This way users with only administrator role will be able to edit other administrators :)
Any suggestions or feedback would be highly appreciated.

Answer 5

Did you see the Advanced User module? Which allows to filter users list and apply action on them like block/unblock. Details from its project page:

The advanced user module allows the filtering of users based on the user.module fields and optionally the profile.module fields. The fields available for filtering can be configured using the module settings. Eg. Site admin may search through 1000s of users to display all users who have not accessed their account.

Once the group of users with selected common denominators are filtered, the module can be used to perform functions that email, block, unblock, add or remove roles, or delete. Another nice feature is the ability to notify administrators or other roles, by email, of user account creation or profile changes.