Adding and Removing Concrete5 Users

Complete guide to managing users, groups, and permissions in Concrete CMS (formerly Concrete5)

Comprehensive guide for managing Concrete CMS user accounts, from creating new users to safely removing access.

Prerequisites

To manage users, you must have:

Administrator access in Concrete CMS
Permission to manage users and groups
Understanding of group-based permissions

System Requirements:

Concrete CMS v8 or later recommended
PHP with appropriate permissions
Database access for bulk operations

Adding Users to Concrete5

Method 1: Dashboard Interface

Best for: Individual user creation

Step 1: Access User Management

Dashboard → Members → Users → Add User

Screenshot reference: /screenshots/concrete5-add-user.png

Step 2: Enter User Information

Required Fields:

Username: Unique identifier (alphanumeric, hyphens, underscores)
Email: Valid email address (must be unique)
Password: Strong password required
- Minimum 8 characters
- Mixed case, numbers, symbols recommended

Optional Fields:

First Name: User's first name
Last Name: User's last name
Language: Interface language preference
Timezone: User's timezone

Step 3: Assign Groups

Select user groups:

Administrators (full access)
Editors (content editing)
Authors (content creation)
Registered Users (basic access)
Custom groups

Multiple groups: Users can belong to multiple groups

Permission stacking: Permissions from all groups combine

See Roles & Permissions for group details.

Step 4: Configure Additional Settings

User attributes (optional):

Profile information
Custom user attributes
Avatar/profile picture
Bio/description

Notification settings:

Email notifications
Workflow notifications
System updates

Step 5: Save User

Click "Add User"
Confirmation message appears
User receives email (if configured)
- Welcome message
- Account details
- Password reset link (if applicable)

Method 2: Public Registration (If Enabled)

Allow visitors to register:

Dashboard → System & Settings → Registration → Enable

Configuration:

Approval required: Admin must approve
Auto-approval: Instant access
Email validation: Verify email first
Default group: Assign new users to group
CAPTCHA: Prevent spam registrations

Workflow:

User fills registration form
Email verification (if required)
Admin approval (if required)
Account activated
User can log in

Method 3: Bulk User Import

Best for: Migrating users, large teams

Prepare CSV File

username,email,password,firstName,lastName,groups
johndoe,john@example.com,TempPass123,John,Doe,Editors
janesmit h,jane@example.com,TempPass456,Jane,Smith,"Editors,Authors"
bobadmin,bob@example.com,TempPass789,Bob,Admin,Administrators

Using Add-on or Custom Script

Via Package/Add-on:

Install user import package
Dashboard → Users → Import
Upload CSV file
Map fields
Configure options:
- Send welcome emails
- Require password reset
- Assign to groups
Import users

Via PHP Script:

use Concrete\Core\User\UserInfo;
use Concrete\Core\User\Group\Group;

$csv = array_map('str_getcsv', file('users.csv'));
$header = array_shift($csv);

foreach ($csv as $row) {
    $data = array_combine($header, $row);

    try {
        $userInfo = UserInfo::add([
            'uName' => $data['username'],
            'uEmail' => $data['email'],
            'uPassword' => $data['password']
        ]);

        // Add to groups
        $groups = explode(',', $data['groups']);
        foreach ($groups as $groupName) {
            $group = Group::getByName(trim($groupName));
            if ($group) {
                $userInfo->getUserObject()->enterGroup($group);
            }
        }

        echo "Created: " . $data['username'] . "\n";
    } catch (Exception $e) {
        echo "Error: " . $e->getMessage() . "\n";
    }
}

Method 4: API User Creation

For integrations and automation:

use Concrete\Core\User\UserInfo;
use Concrete\Core\Support\Facade\Application;

$app = Application::getFacadeApplication();

$data = [
    'uName' => 'newuser',
    'uEmail' => 'newuser@example.com',
    'uPassword' => 'SecurePassword123!'
];

try {
    $ui = UserInfo::add($data);

    // Add attributes
    $ui->setAttribute('first_name', 'New');
    $ui->setAttribute('last_name', 'User');

    // Add to group
    $group = Group::getByName('Editors');
    $ui->getUserObject()->enterGroup($group);

    return $ui;
} catch (Exception $e) {
    // Handle error
}

Managing Existing Users

View Users

Dashboard → Members → User Search

Search and filter:

By username or email
By group membership
By registration date
By active/inactive status
Advanced search options

Edit User Information

Dashboard → Members → User Search
Find user
Click username
Modify details:
- Email address
- Password (reset)
- Groups
- Attributes
- Permissions
Save changes

Change User Groups

Add to group:

Edit user
Groups tab
Select group
Save

Remove from group:

Edit user
Groups tab
Deselect group
Save

Bulk group changes:

Dashboard → Members → Group Sets
Select users (bulk selection)
Add to group or remove from group

Reset User Password

Admin-initiated reset:

Edit User → Change Password → Enter new password → Save

User-initiated reset:

Login page → Forgot Password → Enter email → Reset link sent

Force password change on next login:

$ui = UserInfo::getByID($userID);
$ui->setAttribute('must_change_password', true);

Activate/Deactivate User

Deactivate (suspend):

Edit User → Deactivate User

Effects:

Cannot log in
Retains all data
Can be reactivated
Preserves group membership

Use for:

Temporary suspension
Inactive employees
Security incidents
Pending investigation

Removing Users from Concrete5

Pre-Removal Checklist

Review user's content: Pages, files, blocks created
Reassign ownership: Transfer to another user
Export user data: For compliance (GDPR)
Check workflows: Any pending approvals
Document removal: Reason and date
Notify team: If applicable

Method 1: Delete via Dashboard

Step 1: Navigate to User

Dashboard → Members → User Search → Find user

Step 2: Delete User

Click username to edit
Scroll to bottom
Click "Delete User" button

Confirmation dialog:

Are you sure you want to delete this user?
Content created by this user will be preserved.
This action cannot be undone.

Click "Delete" to confirm

What happens:

User account deleted
Cannot log in
Content preserved (pages, files, etc.)
Username becomes available

Method 2: Bulk User Deletion

Via user search:

Dashboard → Members → User Search
Filter users to delete
Select users (checkboxes)
Bulk actions → Delete
Confirm deletion

Via script (careful!):

use Concrete\Core\User\UserInfo;

$userIDs = [123, 124, 125]; // IDs to delete

foreach ($userIDs as $uID) {
    $ui = UserInfo::getByID($uID);
    if ($ui) {
        try {
            $ui->delete();
            echo "Deleted user ID: " . $uID . "\n";
        } catch (Exception $e) {
            echo "Error deleting " . $uID . ": " . $e->getMessage() . "\n";
        }
    }
}

Method 3: Soft Delete (Deactivate Instead)

Better approach for most cases:

Deactivate user instead of delete
Preserves complete user history
Can be reactivated if needed
Maintains data integrity

$ui = UserInfo::getByID($userID);
$ui->deactivate();

Special Scenarios

Removing Administrator

Cannot remove last administrator:

System requires at least one admin
Create backup admin first
Then remove original

Steps:

Add new administrator
Verify new admin can log in
Test admin permissions
Remove original administrator

Emergency Access Removal

Security incident:

Deactivate immediately: Edit user → Deactivate
Change password: If compromise suspected
Review recent activity: Check logs
Audit changes: Pages edited, files uploaded
Remove from groups: Strip permissions
Document incident: Security log

Post-incident:

Full security audit
Review all user permissions
Update security policies
Consider two-factor authentication

Right to be forgotten:

use Concrete\Core\User\UserInfo;

// Anonymize user data
$ui = UserInfo::getByID($userID);

// Remove personal data
$ui->update([
    'uEmail' => 'deleted-user-' . $userID . '@example.com',
    'uName' => 'deleted-' . $userID
]);

// Remove attributes
$ui->clearAttribute('first_name');
$ui->clearAttribute('last_name');
$ui->clearAttribute('avatar');

// Optional: Delete account entirely
$ui->delete();

Group Management

Create New Group

Dashboard → Members → Groups → Add Group

Configuration:

Group name
Description
Parent group (if hierarchical)
Default permissions
Expiration (optional)

Assign Permissions to Group

Dashboard → System & Settings → Permissions → Advanced Permissions

Set permissions:

Page permissions
File manager permissions
Sitemap permissions
Task permissions
Custom permissions

Apply to group:

Select permission area
Add group
Configure access level
Save

Monitoring and Auditing

View User Activity

Dashboard → Reports & Workflow → Logs → Authentication

Tracked events:

Login/logout
Failed login attempts
Password changes
Permission changes
User creation/deletion

Filter by:

User
Date range
Event type

Regular Audits

Monthly review:

List all active users
Verify group memberships
Check inactive users (90+ days)
Review administrator accounts
Update documentation

Quarterly audit:

Full permission review
Remove unnecessary accounts
Update group structures
Security assessment

Best Practices

Adding Users

Security-first:

✓ Use strong password policy
✓ Assign to appropriate groups only
✓ Enable email verification
✓ Require admin approval for sensitive sites
✓ Use least privilege principle
✓ Document user purpose
✓ Set review date

Avoid:

✗ Giving Administrator by default
✗ Sharing accounts
✗ Weak passwords
✗ No email verification

Removing Users

Clean offboarding:

✓ Deactivate same day as departure
✓ Review and reassign content
✓ Export data if required
✓ Document removal
✓ Update team documentation
✓ Audit permissions