In our sites, I have an Admin role (me) and Staff roles. The Staff role needs to be able to create client user accounts and assign client specific roles to those accounts. How can I give my staff the permission to set other's roles but not their own? I don't want them changing themselves to an admin when they want to (and they have).


I have used this with some success in the past: http://drupal.org/project/role_delegation

I believe I also ended up formatting some of the user profile edit forms to make it simpler for the end user, but I can't quite recall.

  • Applied this today and it is exactly what I wanted. Thanks and a green checkmark for you. – zkent Apr 12 '13 at 1:05

It really sounds like there should be a module that does this ... I'm not aware of 1 offhand.

You could use hook_form_alter on the user account form and simply check the role of the logged in user. If they are Staff allow them to set roles to all but the Admin role you've defined. You would simply unset() the admin value in the $options array for the Roles checkboxes.

For example:

function MYMODULE_form_user_profile_form_alter(&$form, &$form_state, $form_id) {
  global $user;
  if (array_search('Staff', $user->roles)) {
    // Any RIDs you want to remove.

You would also probably want to add a validator to this form to check that a Staff user does not try to get around this by setting this value for instance via Firefox's Firebug. I leave that exercise to you.

  • Good suggestion. Next time I am in the code I will try this out. Boundaries are a good thing. – zkent Dec 18 '12 at 18:36

It sounds like you want Administer Users By Role:

If the user-being-edited has multiple roles, the user-doing-the-editing must have permission to edit ALL of the user-being-edited's roles.

This seems like it would prevent users from administering themselves, if they were given a role they couldn't administer.

  • Apparently I am not the only one with this problem. I am going to try these modules soon. Thx. – zkent Dec 18 '12 at 21:01
  • This might have done the trick too but role_delegation did exactly what I wanted. Thx. – zkent Apr 19 '13 at 17:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.