Should the list of users in Sitecore User Manager be empty, when using Sitecore Client Account Managing role?

Question

I need a role that only allows creation/edition/delete of the users, roles and domains in Sitecore 8.1. I've done some research and the sitecore\Sitecore Client Account Managing role fits.

Regarding some Sitecore documentation, sitecore\Sitecore Client Account Managing role "gives the user access to maintain users, roles, and domains in the Access Manager, the Domain Manager, the Role Manager, and the User Manager".

I've created an user, member of Account Managing role, and the user has access to Access Manager, Domain Manager, Role Manager, and User Manager. However, the list of users in User Manager is empty. The user is able to create a new user and add some roles to it, however it is not able to see the list of the existing/new users.

In order to see the list of existing/new users I need to login as admin.

Please let me know if anyone faced similar issue.

Answer 1

I tested this on a clean version of Sitecore 8.1.1, 8.1.3, and 8.2.3 and - as confirmed by @maz - a user with the Sitecore Client Account Managing role should have access to view the list of items.

There are a couple of things that I would do to try to validate and correct the issue:

1. Install a clean core database and point your connection strings at it. Log in as an admin and create some test users, including one, testmanager (name is arbitrary), that has only the sitecore\Sitecore Client Account Managing role. Log out of the admin account and log back in with the "testmanager" account. Verify that you can see the list of users. If this works, then you know that the issue is in your core database only, and can be solved by replacing it. If not, then you may have another corruption in your Sitecore instance. At this point, I would continue to Step 2.
2. Only try this after you have tried Step 1. Go into your App_Config folder and replace your configs, excluding your ConnectionStrings and DataFolder settings, with clean ones. Specifically, make sure that you have replaced those in the App_Config\Security folder. If that doesn't work, replace the remainder of the configs, still excluding ConnectionStrings and DataFolder settings, and retest. If you are still unable to see the list of users at this point, there is a more serious issue with your Sitecore instance. I recommend that you file a Sitecore Support Ticket and send then a full Sitecore Support Package, using SSPG.
3. Reconnect your original core database and add all of the custom and default security roles available to a new "testmanager" account. Log in as the "testmanager" user and verify that you can see the list of all users. Either one-by-one (brute-force-search) or in groups (binary-search), remove roles from the "testmanager" user until the list of displayed roles is no longer displayed. If troubleshooting via binary-search, re-add the last set of removed roles and proceed with brute-force-search until you find the role that is required to see the list. Note that this investigation step seeks to find a role that grants the ability to see the list of users in the User Manager. If there is not, then you know that replacing your core database is your only viable option.

Answer 2

By default, your user should be able to see all users. However, the likeliest explanation is that this access has been restricted to specific domains on which no users exist.

While logged in as admin, check the "Member of" tab of your user, and click the "Domains" button. Make sure to either add or remove all domains if you want the user to manage users for all domains.