[Apoclada]

I am using V2.8. It seems a loophole with Manager role. The user with manager role can edit admin user profile and also can add him self into admin role. After he log in again, he can do anything!

[OscarBarrientos]

Hi Apoclada,
You can edit the Manager Role or create a custom role in order to add or remove permissions.
The PM_USERS permission provides access to the Users tab under the ADMIN menu and the ability to create, edit and delete users, groups, departments and roles, you can remove that permission from Manager Role.
Follow this link for more information about roles and permissions:
http://wiki.processmaker.com/index.php/ ... ting_Roles

Regards

[Apoclada]

Hi, Oscar:

I know permissions can be selected for a given role. What if we need the manager to manage users, but not to touch admin account and not to upgrade his own role? Which permission is suitable for that requirement? Thanks.

BR

[OscarBarrientos]

What you can do is to create a trigger and a dynaform to edit and/or create users based in these two ProcessMaker functions:
PMFCreateUser()
http://wiki.processmaker.com/index.php/ ... User.28.29
PMFUpdateUser()
http://wiki.processmaker.com/index.php/ ... User.28.29

You can use a couple of dropdowns, one to select the role and other to show the user list according to the value of the previous dropdown, in this case admin role must not be in the first dropdown (to avoid modifying the admin account). Once the user's permission has been selected and modified you can hide the 'PROCESSMAKER_ADMIN' role to unable the user to be upgraded with an admin role. In case the manager user needs to create user's account it is necessary to validate the information to not let him to create admin users or assign any role with the PM_USERS permission.

The PM_USERS permission will only be assigned to the admin user and the manager user will only manage the users through the dynaform created, so that the manager user will not be able to upgrade his role or modify admin account.

Dependent fields might be necessary:
http://wiki.processmaker.com/index.php/Dependent_Fields

I hope it helps you to achieve your requirements.

[Apoclada]

This walk around idea is cool. A dynaform is used like an application. We may route the step to it self so that the case is never ending.
(But it will be even great if the PM permission can directly solve the problem in the future.)