/admin/auth/user/add/ requires "auth | user | Can change user" permission

[Michael Angeletti]

I'm getting a 403 when I visit the /admin/auth/user/add/ with a staff User that has only auth | user | Can add user permission. After adding auth | user | Can change user, I'm able to access the aforementioned URL without issue.

[Tim Graham]

This is expected behavior. Please see the ​auth documentation.

Also note: if you want a user account to be able to create users using the Django admin site, you’ll need to give them permission to add users and change users (i.e., the “Add user” and “Change user” permissions). If an account has permission to add users but not to change them, that account won’t be able to add users. Why? Because if you have permission to add users, you have the power to create superusers, which can then, in turn, change other users. So Django requires add and change permissions as a slight security measure.

[Michael Angeletti]

Ah, I see. Thanks for the explanation, @timgraham.

Because the User create form includes only username and password fields (no permission and staff/superuser fields), I wonder if it's worth exploring the option of changing this (e.g., user with only "can add User" permission adds a User with a username and password, is redirected back to the User list view).

[Tim Graham]

Maybe... I didn't research when that restriction was added to see if things have changed since then.