Drupal - User Management

User management in Drupal involves controlling who can access your site, what they can do, and how their accounts are managed. This is primarily handled through Users, Roles, and Permissions.

Users

Each individual who interacts with your site in a registered capacity has a user account.

To manage users, navigate to ‘Manage’ > ‘People’ (usually /admin/people).

Viewing Users: This page lists all registered users. You can filter and search for users.
Adding a User: Click the ’+ Add user’ button. You’ll need to provide a Username, Email address, Password, and assign Roles. You can also set the user’s status (Active or Blocked).
Editing a User: Click ‘Edit’ in the operations column for a user to modify their details, change their password, assign roles, or block/unblock their account.
Deleting a User: From the edit page or operations dropdown, you can delete a user. You’ll be asked what to do with their content (e.g., attribute to Anonymous, delete content, or reassign to another user).

Roles

Roles are groups of users that share the same set of permissions. Instead of assigning permissions to each user individually, you assign permissions to roles, and then assign roles to users.

Navigate to ‘Manage’ > ‘People’, then click the ‘Roles’ tab (or it might be a direct link under People, e.g., /admin/people/roles).

Default Roles:

Anonymous user: Visitors who are not logged in.
Authenticated user: Any user who has logged in.
Administrator: A role with extensive (often all) permissions. Typically, User ID 1 is the super administrator and bypasses all access checks.

Adding a Custom Role:

Click the ’+ Add role’ button.
Enter a ‘Role name’ (e.g., ‘Editor’, ‘Content Moderator’, ‘Subscriber’). The machine name will be generated automatically.
Click ‘Save’.

You can then assign permissions to this new role.

Permissions

Permissions define what actions users with specific roles can perform on the site.

Navigate to ‘Manage’ > ‘People’, then click the ‘Permissions’ tab (e.g., /admin/people/permissions).

The permissions page displays a grid with permissions listed down the rows and roles across the columns. Check the box where a permission intersects with a role to grant that permission to that role.

Key Permission Categories (modules provide their own sets of permissions):

Block: Administer blocks and block layout (e.g., ‘Administer blocks’).
Comment: Manage comments (e.g., ‘Post comments’, ‘Administer comments and comment settings’, ‘Skip comment approval’).
Contextual links: ‘Use contextual links to perform actions’.
Filter: ‘Administer text formats and editors’.
Image: (Now part of Media) Permissions related to image styles are often under Media permissions.
Media: Administer media types, media items, and media library (e.g., ‘Create image media’, ‘View media’).
Menu: Administer menus and menu links (e.g., ‘Administer menus and menu links’).
Node (Content): Core content permissions, often granular per content type (e.g., ‘Article: Create new content’, ‘Article: Edit own content’, ‘Article: Delete any content’). This is a critical section.
Path: Administer URL aliases (e.g., ‘Administer URL aliases’, ‘Create and edit URL aliases’).
Search: ‘Use search’.
Shortcut: ‘Administer shortcuts’, ‘Use shortcuts’.
System: Site-wide administrative permissions (e.g., ‘Administer site configuration’, ‘Access site reports’, ‘View the administration theme’).
Taxonomy: Manage vocabularies and terms (e.g., ‘Administer vocabularies and terms’, ‘VocabularyName: Create terms’, ‘VocabularyName: Edit terms’).
Toolbar: ‘Use the administration toolbar’.
User: Manage users and roles (e.g., ‘Administer users’, ‘Administer roles and permissions’, ‘Access user profiles’).

After making changes to permissions, scroll to the bottom and click ‘Save permissions’.

Best Practice: Follow the principle of least privilege. Grant roles only the permissions they absolutely need to perform their tasks.