User

A user in Drupal is an account stored as an entity of the type user. It has a numeric user ID, a username, an email address, a password and a status, and it can hold any number of roles. Whatever a person does after logging in runs as that account. Visitors who are not logged in are represented as user ID 0.

How it works in Drupal 11

The class is Drupal\user\Entity\User, and it implements UserInterface, which extends AccountInterface. Accounts live in the tables users and users_field_data, with uid as the ID key. The entity is translatable. Its canonical page is /user/{user}, the edit form is /user/{user}/edit, and the admin list is /admin/people. The user type declares no bundles, so there are no user types: you add fields to the one account type, and the account settings page at /admin/config/people/accounts is the base route for that.

The interface has methods for the common jobs: addRole(), removeRole(), block(), activate(), isBlocked(), setPassword() (it takes the plain password, which Drupal hashes when the account is saved) and getLastLoginTime(). Access is granted through roles. The Drupal User Guide puts it this way: permissions are grouped into roles, and an account gets the permissions of its roles. Every logged-in account also receives the authenticated role automatically. The first account, user 1, is a special case.

Example

Go to People (/admin/people) and choose Add user. The form asks for an email address, a username, a password with confirmation, a status, the roles, and whether to notify the user. A status of Blocked stops the person from signing in. The same job in code:

$user = \Drupal\user\Entity\User::load(5);
        $user->addRole('content_editor');
        $user->save();

This assumes a role with the machine name content_editor exists.

Common mistakes

• Sharing one account. The site log then cannot show who changed a page. Give each person an account.
• Deleting an account without choosing what happens to its content. Core offers four cancellation methods, from keeping the content to deleting it with the account. Pick one on purpose; blocking is the reversible option.
• Looking for permissions on the user form. They are not there. Change the roles, or change the role's permissions.
• Using user 1 for daily work. By default that account holds every permission, which hides role problems.

For marketing and content teams

You need a personal account with the roles your work requires, not a shared login. People with the right permission can find accounts on the People page, where the User Guide describes a filter for name or email. If you leave the team, ask for your account to be blocked rather than deleted, so your published content keeps its author.

Sources

• Drupal User Guide: Concept: Users, roles and permissions
• Drupal User Guide: Creating a user account
• User entity class, Drupal core source
• UserInterface, Drupal core source
• AccountInterface, Drupal core source
• user_cancel_methods function, Drupal core source (11.2.0)
• User module routing, Drupal core source (11.2.0)
• Drupal User Guide: Changing a user's roles
• PasswordItem field type, Drupal core source (11.2.0)
• Core services, security.enable_super_user parameter (11.2.0)