Cannot see any user role as user manager while creating new users in DHIS2

Question

I want to create a DHIS 2 user which should function as a user manager. This user manager should only be given the authorities to create new users, and not other types of authorities.

I have created a user role "User manager" with authorities for creating, updating and deleting users, and accessing the user module.

However, when logging in as that user and trying to create a new user, no user roles are available in the user role selection list.

I would expect to see other user roles. Why is this happening?

Answer 1

This is in fact the expected behavior. A key principle for user roles in DHIS 2 is that a user can only grant user roles to new users for which she has all authorities herself. Said differently, user roles which contain authorities which the current user do not have will be hidden and not be possible to grant.

This design is put in place in order to allow for distributed user management, meaning you can have users with limited authority being able to create new users with the same or less, but more, authorities.

As an example, a system admin can create a province user with authorities A, B, C. The province user can create a district user with authorities A, B. The district user can create a facility user with authority A. This way, creation of users can be distributed and delegated.

On the contrary, if this restriction was not in place it would mean that giving a person the authority to create new users would in reality grant full access to the system to that person. Such a person would have the option for creating a new user with full authority for herself, then log in as that user and perform any operation within the system.

As a result, it is not possible to create a "user manager" user only; one must provide that user with all of the authorities (through user roles) that one would like that person to be able to grant to others.