How do I find out which users have permissions to add/remove other users?

Question

From what I understand, There are 3 base roles which can do this:

1. Sitecore Local Administrators
2. Sitecore Client Securing
3. Sitecore Client Account Managing

So I suppose if I want to get the roles which inherit from these base roles I'll do a query to my database consisting partly of this:

After to find out which users have this I'll do another query on the Users Database to find out which users have these rights.

ANYWAYS, I suppose the question is really then which base roles have permissions to add/remove other users from sitecore?

Answer 1

Sitecore Client Account Managing is the right role to add/remove users.

From Sitecore Documentation :

Gives the user access to maintain users, roles, and domains in the Access Manager, the Domain Manager, the Role Manager, and the User Manager.

https://doc.sitecore.com/en/developers/90/platform-administration-and-architecture/the-security-roles.html

To view the members of this Role open Sitecore Client Account Managing role in user manager and click Members:

Answer 2

There is no OOTB functionality to get users that can remove other users, but you can use some workarounds.

I suggest using an API call below to check if you have enough permissions to call the User Manager application for the current user:

SecurityHelper.CanRunApplication("Security/User Manager");

Then you can go through all users and you can use a similar code to check if the specified user can open the application:

List<Sitecore.Security.Accounts.User> powerUsers = Sitecore.Security.Accounts.UserManager.GetUsers()
    .Where(user => CanRunApplication("Security/User Manager", user))
    .ToList();

public static bool CanRunApplication([CanBeNull] string applicationName, [CanBeNull] Sitecore.Security.Accounts.User user)
{
    if (user == null 
        || applicationName.IsNullOrWhiteSpace())
    {
        return false;
    }

    if (!applicationName.StartsWith("/", StringComparison.InvariantCulture))
    {
        applicationName = "/sitecore/content/Applications/" + applicationName;
    }

    using (new UserSwitcher(user))
    {
        Sitecore.Data.Items.Item item;
        using (new Sitecore.SecurityModel.SecurityDisabler())
        {
            item = Sitecore.Client.CoreDatabase.GetItem(applicationName);
        }

        return item != null && item.Access.CanRead();
    }
}

Few points to highlight there:

1. Actually, if you have read permissions to "/sitecore/content/Applications/Security/User Manager" item, then you can call this application.
2. "New" and "Delete" buttons are always enabled.

So, if you have permission to open this application then you can create/delete users.

Answer 3

Sitecore OOTB Role to maintain user is Sitecore Client Account Managing. So to check who all can manage user, we should be checking which all users are associated with this role.

Role: Sitecore Client Account Managing
Gives the user access to maintain users, roles, and domains in the Access Viewer, the Domain Manager, the Role Manager, and the User Manager applications.

Steps to check list of user having part of this role

• Click on Role Manager on Launchpad
• Select sitecore\Sitecore Client Account Managing
• Click on Members from the Menu

https://doc.sitecore.com/en/developers/101/platform-administration-and-architecture/the-security-roles.html