Users, Roles, and Permissions

Drupal can allow authenticated users to perform specific actions based on their granted permissions. This chapter presents Drupal’s user system and role-based access control (RBAC) mechanisms. Drupal can model user profiles, create specific roles for those users, and grant users assigned permissions. In an enterprise setting, Drupal developers need to understand how to configure the same Drupal application to serve different user personas and manage the access of each persona accordingly. This chapter covers how to address these use cases through the user, role, and permissions capabilities.

In this chapter, we’re going to cover the following main topics:

• Users
• Roles
• Permissions

Users

Drupal core has a subsystem for user management. The foundational feature serves as the tool in which users can access Drupal’s backend systems. This is fundamental for site builders and content managers.

User entity

The user subsystem starts with the user entity. This entity, like others, is built on top of the entity system and is afforded structured data and management for Drupal users.

The user entity is fieldable. Enabling fields for users affords the ability for site builders to configure user profiles. By default, the user entity has a username, password, and email, all of which can’t be modifiable but can be harnessed by the features in the user subsystem.

Features

The user subsystem has several features that are built on top of the user entity.

Users can log into Drupal to perform administrative actions and manage content, as well as site-building. This leverages the entity’s username and password. The following figure shows Drupal...

Roles

Roles are the different user personas for the Drupal application and are granted to users that match that persona. An effective content management analogy ties to publications that have authors and editors. The two personas have two different functions: one to write content and one to review and approve content. In Drupal, a role is effective at establishing different personas.

This goes beyond just content-related use cases as Drupal can also leverage roles for performing specific administrative actions. Consider a human resources use case where new joiners need accounts on the Drupal application or accounts need to be revoked for those who leave. A specific role can be established that is just able to manage accounts.

Role entity

Like a user, a role is an entity. It is a very simple configuration entity that only has a name and is not fieldable. Given that the entity system allows for relationships between entities, a user entity has a one-to-many relationship with...

Permissions

A permission is an action that is granted to a role. Authorization happens when a user attempts to perform an action that is managed by permission. The role of that user is dereferenced and a set of aggregated permissions that have been granted to the user are checked.

Access control

Drupal leverages permissions as its means of access control. Users are assigned specific roles. Those roles have specific permissions assigned to them. Access control happens when a user attempts to act Drupal. Drupal will perform authorization based on the permissions granted to roles. As a simple example, the “manage users” permission can be granted to a role for human resources (HR), who are responsible for managing new hires or attrition. When one of the members of HR logs in and tries to go to Drupal’s user management page, they are granted access where other Drupal users would not.

Important note

It is good practice to implement a “least privilege...

Summary

Users, roles, and permissions help Drupal manage access for various personas. These features are used by Drupal to provide fine-grained access controls to users of the Drupal system. Drupal can then perform authorization tied to specific system actions. These features exemplify Drupal’s extensibility for use cases tied to various personas and the specific actions each persona can be allowed to perform. Drupal’s modules help define the actions as permissions and the logic to authorize actions. The next chapter covers a complex but powerful feature in Drupal called Views that is used to create dynamic content displays.