[kamaldua]

Case: If a user is given access to add new user then he/she can make a new user with System Administrator privileges. How do I do following:
1. Hide all users with 'System Administrator' roles in the users list.
2. remove 'System Administrator' option from role dropdown so new new user can be added with 'System Administrator' access.

I tried putting where cluase in sql but does not seem to work. Any leads.

Thanks

[amosbatto]

1. If you are using an SQL query to get a list of all users in a dropdown box who do not have the PROCESSMAKER_ADMIN role, then you can use this:

Code: Select all

SELECT U.USR_UID, CONCAT(U.USR_FIRSTNAME, ' ', U.USR_LASTNAME, ' (', U.USR_USERNAME, ')') FROM RBAC_USERS_ROLES UR, RBAC_USERS U, RBAC_ROLES R WHERE R.ROL_CODE<>'PROCESSMAKER_ADMIN' AND R.ROL_UID=UR.ROL_UID AND UR.USR_UID=U.USR_UID

2. You can hack the PM source code to remove the PROCESSMAKER_ADMIN from the dropdown, but the easiest way to do this is add a "Create User" process. In that process, create a DynaForm with the fields to add a new user:

Code: Select all

FirstName [       ]
LastName [       ]
...
Role  [           ] 

Where Role is a dropdown box with PROCESSMAKER_OPERATOR and any other roles you want.
Then, add a trigger which is executed after the DynaForm, to either uses PMFCreateUser() or REST POST /api/1.0/{workspace}/user to add the new user. If the logged-in user doesn't have the PM_USERS permission in his role, then login with REST as a user who has the PM_USERS permission in his role and then use the POST /api/1.0/{workspace}/user endpoint.