Tiered user management permission configuration

User Protect can be configured to allow a tiered delegation of user management without loosing control of the site.

When combined with Role Delegation module permission configuration can be set to prevent a user from granting themselves admin role permissions and gaining control of site.

The following configuration was tested with Drupal 5.10, 'User Protect 5.x-1.3' and 'Role Delegation 5.x-1.1' modules.

http://drupal.org/project/userprotect
http://drupal.org/project/role_delegation

Roles:

• Administrator
• Manager
• Editor
• Authenticated User

Requirements for Administrator role:

• edit all users
• grant any Role
• edit all user fields except username
• delete users

Requirements for Manager role:

• restricted from editing Admin users
• restricted to granting Roles of equal or lessor permissions
• edit all user fields except username
• delete users

Requirements for Editor role:

• restricted from editing Admin users
• restricted to granting Roles of equal or lessor permissions
• edit own user fields except username

Edit Restrictions

  user   | administrator |  manager   | editor                        |authenticated user
--------------------------------------------------------------------------------------------------
 admin    | Unrestricted  | Restricted | Restricted                     | Restricted
 manager  | Unrestricted  | username   | Restricted                     | Restricted
 editor   | Unrestricted  | Username   | Username, status, roles, delete| Restricted
Auth user| Unrestricted  | Username   | Restricted                     | Restricted

Access control settings:

user module>                    Admin | Manager | Editor | Authenticated User
access user profiles?              X  |    X    |   --   |        --
administer access control?         X  |   --    |   --   |        --
administer users?                  X  |    X    |   --   |        --
change own username?              --  |   --    |   --   |        --

role_delegation module>        Admin | Manager | Editor | Authenticated User
assign administrator role?        X  |    --   |   --   |       --
assign editor role?               X  |     X   |    X   |       --
assign manager role?              X  |     X   |   --   |       --

user_protect module>      Admin | Manager | Editor | Authenticated User
administer userprotect?      X  |    X    |   --   |       --
change own e-mail?           X  |    X    |    X   |        X 
change own password?         X  |    X    |    X   |        X 

User_Protect module settings

Protected users

 User   | Username | E-mail | Password | Status | Roles | Deletion | All account edits
Visitor|     --   |   --   |    --    |   --   |   --  |     X    |        X
Admin  |     X    |    X   |     X    |    X   |    X  |     X    |        X
Sysop  |     X    |    X   |     X    |    X   |    X  |     X    |        X

Protected roles

       Role       | username | e-mail | password | status | roles | deletion | all account edits
administrator     |     X    |    X   |     X    |    X   |   X   |     X    |        X
authenticated user|     X    |   --   |    --    |   --   |   --  |     X    |        --
editor            |     X    |   --   |    --    |   --   |   --  |     X    |        --
manager           |     X    |    X   |     X    |    X   |   X   |     X    |        X

Administrator bypass

  User  | Username | E-mail | Password | Status | Roles | Deletion | All account edits
 Admin   |     X    |    X   |     X    |    X   |   X   |     X    |        X
Manager |    --    |    X   |     X    |    X   |   X   |     X    |        --
 Sysop   |     X    |    X   |     X    |    X   |   X   |     X    |        X

Protection defaults

X | username
--| e-mail
--| password
X | status
X | roles
X | deletion
X | all account edits

X | Auto-protect new users

Administrator bypass defaults:

-- | username
-- | e-mail
-- | password
-- | status
-- | roles
-- | deletion
-- | all account edits