Adding & Removing Users on Liferay | OpsBlu Docs

Adding & Removing Users on Liferay

Adding & Removing Users on Liferay — setup, configuration, and best practices for Liferay.

Liferay DXP provides one of the most comprehensive user management systems in enterprise CMS platforms. Users are managed through the Control Panel, LDAP synchronization, or the headless REST API. Liferay distinguishes between portal-level users, organization users, and site members.

How Liferay User Management Works

Liferay stores users in its own database but can synchronize with external identity providers (LDAP, SAML, OpenID Connect). The user model includes:

  • Regular Users -- Standard accounts with portal access
  • Organization Users -- Users assigned to organizational hierarchies
  • Site Members -- Users with access to specific sites within the portal
  • Service Accounts -- Non-interactive accounts for API integrations

The Control Panel is accessible at https://your-portal.com/group/control_panel for administrators.

Adding Users via Control Panel

  1. Navigate to Control Panel > Users and Organizations
  2. Click the Add button (+ icon) in the top-right corner
  3. Fill in the required fields:
    • Screen Name (unique identifier, auto-generated if blank)
    • Email Address (required, must be unique)
    • First Name and Last Name
    • Job Title (optional but useful for organizational grouping)
  4. Click Save
  5. Liferay sends a password setup email to the new user
  6. Assign the user to Sites and Organizations as needed from their profile

Assigning Users to Sites

  1. Go to Control Panel > Sites
  2. Select the target site
  3. Click Memberships in the left menu
  4. Click New to add members
  5. Search for and select the user(s)
  6. Choose a Site Role (Site Administrator, Site Content Reviewer, Site Member)
  7. Click Done

Adding Users via Headless REST API

Liferay DXP 7.4+ provides a headless API for user management:

# Create a new user via REST API
curl -X POST "https://your-portal.com/o/headless-admin-user/v1.0/user-accounts" \
  -H "Content-Type: application/json" \
  -H "Authorization: Basic $(echo -n 'admin@company.com:password' | base64)" \
  -d '{
    "alternateName": "jdeveloper",
    "emailAddress": "jane@company.com",
    "familyName": "Developer",
    "givenName": "Jane",
    "password": "TempPass123!",
    "jobTitle": "Frontend Engineer"
  }'

Assign user to a site:

curl -X POST "https://your-portal.com/o/headless-admin-user/v1.0/sites/{siteId}/user-accounts" \
  -H "Content-Type: application/json" \
  -H "Authorization: Basic $(echo -n 'admin@company.com:password' | base64)" \
  -d '{
    "userAccountIds": [12345, 12346, 12347]
  }'

Assign role to user:

curl -X POST "https://your-portal.com/o/headless-admin-user/v1.0/roles/{roleId}/association/user-account/{userId}" \
  -H "Authorization: Basic $(echo -n 'admin@company.com:password' | base64)"

Bulk User Import

CSV Import via Control Panel

  1. Navigate to Control Panel > Users and Organizations
  2. Click the Options (gear) icon
  3. Select Export/Import
  4. Click the Import tab
  5. Upload a CSV file with columns: screenName, emailAddress, firstName, lastName, jobTitle
  6. Map columns in the import wizard
  7. Click Import

Scripting Console Bulk Import

Liferay's Groovy scripting console (Control Panel > Server Administration > Script) supports bulk operations:

import com.liferay.portal.kernel.service.UserLocalServiceUtil
import com.liferay.portal.kernel.service.ServiceContext

long companyId = com.liferay.portal.kernel.util.PortalUtil.getDefaultCompanyId()
long creatorUserId = UserLocalServiceUtil.getDefaultUserId(companyId)

def users = [
    [screenName: "jdoe", email: "jdoe@company.com", first: "John", last: "Doe"],
    [screenName: "asmith", email: "asmith@company.com", first: "Alice", last: "Smith"],
    [screenName: "bwilson", email: "bwilson@company.com", first: "Bob", last: "Wilson"],
]

users.each { u ->
    try {
        UserLocalServiceUtil.addUser(
            creatorUserId,    // creatorUserId
            companyId,        // companyId
            false,            // autoPassword
            "TempPass123!",   // password1
            "TempPass123!",   // password2
            false,            // autoScreenName
            u.screenName,     // screenName
            u.email,          // emailAddress
            java.util.Locale.US,
            u.first,          // firstName
            "",               // middleName
            u.last,           // lastName
            0,                // prefixId
            0,                // suffixId
            true,             // male
            1,                // birthdayMonth
            1,                // birthdayDay
            1970,             // birthdayYear
            "",               // jobTitle
            new ServiceContext()
        )
        println("Created: ${u.email}")
    } catch (Exception e) {
        println("Failed: ${u.email} - ${e.message}")
    }
}

Removing and Deactivating Users

Deactivating preserves all content, workflow history, and audit records:

  1. Navigate to Control Panel > Users and Organizations
  2. Find the user via search
  3. Click the user's name to open their profile
  4. Click Actions (three-dot menu) and select Deactivate
  5. Confirm the deactivation

Deactivated users cannot log in but their content (web content, documents, wiki articles) remains intact and attributed to them. Their assignments in workflows pause.

Reactivation

  1. In Users and Organizations, change the filter to show Inactive users
  2. Find the user
  3. Click Actions > Activate

Permanent Deletion

  1. First deactivate the user (required step)
  2. Switch to the Inactive user filter
  3. Select the user
  4. Click Actions > Delete
  5. Confirm permanent deletion

What happens to their content:

  • Web content authored by the deleted user is reassigned to the default admin user
  • Document library files remain but lose their uploader attribution
  • Workflow tasks assigned to the deleted user become unassigned
  • Message board posts and wiki contributions retain the deleted user's name as a string but lose the link to a live account
  • Comments and ratings are permanently deleted with the user

Deactivation via API

# Deactivate user (set status to 5 = inactive)
curl -X PATCH "https://your-portal.com/o/headless-admin-user/v1.0/user-accounts/{userId}" \
  -H "Content-Type: application/json" \
  -H "Authorization: Basic $(echo -n 'admin@company.com:password' | base64)" \
  -d '{"status": 5}'

LDAP Integration

Liferay DXP integrates with LDAP directories for centralized user provisioning:

  1. Navigate to Control Panel > Instance Settings > Security > LDAP
  2. Click Add to configure an LDAP server
  3. Configure connection settings:
    • Base Provider URL: ldap://ldap.company.com:389
    • Base DN: dc=company,dc=com
    • Principal: cn=admin,dc=company,dc=com
    • Credentials: LDAP admin password
  4. Map LDAP attributes to Liferay fields:
    • cn to Screen Name
    • mail to Email Address
    • givenName to First Name
    • sn to Last Name
  5. Configure Import/Export settings:
    • Enable Import to sync LDAP users into Liferay
    • Set import interval (e.g., every 10 minutes)
    • Enable Export if Liferay should write changes back to LDAP
  6. Click Save and Test LDAP Connection

SAML Single Sign-On

Liferay DXP supports SAML 2.0 as both an Identity Provider (IdP) and Service Provider (SP):

  1. Install the Liferay SAML 2.0 app from the Marketplace (or use the bundled module in DXP)
  2. Navigate to Control Panel > SAML Admin
  3. Configure as Service Provider:
    • Entity ID: https://your-portal.com
    • Upload IdP metadata XML or configure manually
    • Map IdP attributes to Liferay user fields
  4. Enable Auto-provisioning to create Liferay accounts on first SSO login
  5. Enable Auto-update to keep user attributes synced

Access Audit Checklist

  • Review Control Panel > Users and Organizations quarterly, filter by last login date
  • Run Control Panel > Server Administration > Data Cleanup to identify orphaned user data
  • Audit site memberships: check each site's Memberships section for stale accounts
  • Verify LDAP sync logs in Control Panel > Server Administration > Log Levels (set com.liferay.portal.security.ldap to DEBUG)
  • Review Control Panel > Audit (requires Audit module) for recent user login and permission changes
  • Document all role and organization changes in your change management system
Nach oben