"Create own content" only

Hi everyone -

There seems to be a serious permissions issue that I've spent a long time trying to solve, but with no success, so I'm putting it out to the Drupal community for solutions.

The aim is:

1) Standard users (authenticated, non-admin roles) should only be able to create new content through node/add as themselves. i.e. the Authoring Information is automatically populated with the logged in user's information and they should not be able to alter or amend it.

2) Admins should be able to create new content as anyone by using Authoring Information and typing in the username they want to create content under.

At the moment the node/add form displays Authoring Information and Promotion Settings for all roles, and I can't seem to find a way to hide or disable those by role. I can obviously hide them entirely, with some CSS, but then Admins can't access those options and we can't accomplish point 2 above.

Disabling display author and date information by editing the content type, doesn't help us since we do want to display authoring information on the content post itself, we just want standard users not to be able to amend it to pretend to be someone else. Obviously being able to post as someone else causes a significant security issue.

I would have thought that it's a permissions issue, but there is no node permission to "Create Own" content. Right now standard users have permission to "Create new content", "Edit own content", "Delete own content". Whereas Admins can also "Edit any content" and "Delete any content". So with permissions set up this way, you have a strange situation where a standard user can create content under another user's name, and then not be able to edit or delete it!

I've also looked at various modules to solve the problem, mostly designed to customise the node/add form, but none seem appropriate.

Thanks in advance for any help!