Role that can set roles but not change its own In our sites, I have an Admin role (me) and Staff roles.  The Staff role needs to be able to create client user accounts and assign client specific roles to those accounts.  How can I give my staff the permission to set other's roles but not their own?  I don't want them changing themselves to an admin when they want to (and they have).
It really sounds like there should be a module that does this ... I'm not aware of 1 offhand.

You could use hook_form_alter on the user account form and simply check the role of the logged in user. If they are Staff allow them to set roles to all but the Admin role you've defined. You would simply unset() the admin value in the $options array for the Roles checkboxes.

For example:

function MYMODULE_form_user_profile_form_alter(&amp;$form, &amp;$form_state, $form_id) {
  global $user;
  if (array_search('Staff', $user-&gt;roles)) {
    // Any RIDs you want to remove.
    unset($form['account']['roles']['#options'][3]);
  }
}


You would also probably want to add a validator to this form to check that a Staff user does not try to get around this by setting this value for instance via Firefox's Firebug. I leave that exercise to you.