Admin cannot access role tab

The D7 code that handles showing the role selector is as follows:

  $form['account']['roles'] = array(
    '#type' => 'checkboxes',
    '#title' => t('Roles'),
    '#default_value' => (!$register && isset($account->roles) ? array_keys($account->roles) : array()),
    '#options' => $roles,
    '#access' => $roles && user_access('administer permissions'),
    DRUPAL_AUTHENTICATED_RID => $checkbox_authenticated,
  );

If a user only has the 'administer users' permission they cannot change the roles too. As a result the role_delegation_access code simply shouldn't check for 'administer users' and should rely upon the others.

I ran across this earlier and found it very jarring from a usability perspective, that Admin users didn't see the page (and even hit an "access denied" page when trying to manually browse to the URL). I know that they don't "need" it per se, since just editing the user will work fine, but it was particularly odd when I added a contextual role-edit link (user/[current-user:uid]/roles) to the user menu and saw it not appear at all for an admin user.

As a quick and dirty personal change, I just edited FALSE to TRUE in the relevant section, but if the proposed patch removes this issue I am definitely in favor of the module not specifically blocking Admin users from access to the Roles tab.

please add a variable "hide role delegation tab if the user can edit users" or something and default to TRUE, so existing sites will not see this change, as using role delegation on the user edit page only is a valid use case also..

yes, administration page for that variable has to be created..

It’s been a while since the last comments on this issue. If this is still a problem. Feel free to reopen and provide a patch.

#2 does not seem to be committed, so it would perhaps just need a reroll.

Added test coverage.

Committed and pushed to 7.x-1.x. Thanks!

please add a variable "hide role delegation tab if the user can edit users" or something and default to TRUE, so existing sites will not see this change, as using role delegation on the user edit page only is a valid use case also..

There is a separate issue for this: #2858437: user roles showing twice