Authenticated

Authenticated describes a visitor who has logged in to a Drupal site with an active account. Drupal gives every such account the built-in Authenticated user role, on top of any roles you assign by hand. Its counterpart is anonymous, a visitor who is not logged in.

How it works in Drupal 11

The interface AccountInterface defines the role ID constant AUTHENTICATED_ROLE, whose value is the string authenticated, and a method isAuthenticated(). For a User entity the check is simple: an account with an ID above 0 is authenticated, and ID 0 is the anonymous account.

On each request the cookie authentication provider reads the user ID from the session, looks up the account and its roles in the database, and builds the logged-in account for the request. If the account no longer exists or is blocked, the provider does not authenticate the request, so that visitor stays anonymous. The login steps themselves are covered under user authentication.

The authenticated role is not stored on the account. When code calls getRoles(), Drupal adds the ID authenticated to the stored roles, and preSave() strips it again before saving. The role itself is a configuration item with the ID authenticated and the label Authenticated user. The Administrator role setting cannot point at it: the form that picks the administrator role leaves the anonymous and authenticated roles out of its list.

Example

Go to People › Roles (/admin/people/roles) and look at the four roles of a Standard installation: Anonymous user, Authenticated user, Content editor and Administrator. In the Standard profile of Drupal 11.2, the Authenticated user role starts with permissions such as access comments, post comments and use text format basic_html. In code, the question is one call:

$account = \Drupal::currentUser();
        if ($account->isAuthenticated()) {
          // Show the account menu.
        }

Common mistakes

• Granting an editor permission to Authenticated user. The role belongs to every logged-in account, so the permission reaches all of them. Create a separate role for editors.
• Treating logged in as trusted. Authenticated only says that someone has an account. What they may do comes from permissions.
• Trying to take the role away from one account. On the account edit form, Authenticated user is checked and disabled. Block the account instead, or move the permission to a narrower role.
• Mixing it up with user 1. User 1 is one specific account; authenticated describes all logged-in accounts.

For marketing and content teams

Everyone who logs in to your site, from the newest member to the editor in chief, shares this base level of access. If you plan member-only pages or features, ask your developers what the Authenticated user role is allowed to do today. Extra rights for your editors then belong in their own roles.

Sources

• Drupal User Guide: Concept: Users, roles and permissions
• AccountInterface, Drupal core source
• User entity class, Drupal core source
• Cookie authentication provider, Drupal core source (11.2.0)
• RoleSettingsForm, Drupal core source (11.2.0)
• Standard profile: authenticated role configuration (11.2.0)
• Standard profile: content editor role configuration (11.2.0)
• AccountForm, Drupal core source (11.2.0)