Magento User Management | OpsBlu Docs

Magento User Management

Complete guide to managing admin users, roles, and permissions in Magento 2 and Adobe Commerce for secure team collaboration.

Magento 2 provides a comprehensive role-based access control (RBAC) system for managing admin users and their permissions. This guide covers user creation, role assignment, permission management, and security best practices for team collaboration.

Overview

User Management Features

1. Role-Based Access Control (RBAC)

  • Granular permission control
  • Custom role creation
  • Resource-level restrictions
  • API access management

2. User Account Types

  • Admin Users: Full or limited backend access
  • Customer Accounts: Frontend user accounts
  • API Users: Programmatic access via REST/SOAP

3. Security Features

Admin User Structure

Key Components

1. User Account

  • Username (unique identifier)
  • Email address
  • First and last name
  • Password (encrypted)
  • Status (active/inactive)
  • Interface locale

2. Role Assignment

  • Single role per user
  • Multiple users per role
  • Hierarchical permissions
  • Resource restrictions

3. Additional Settings

  • Current user status
  • Last login date
  • Password reset
  • Account locks

Accessing User Management

Admin Panel Navigation

System > Permissions > All Users
System > Permissions > User Roles

User Management Dashboard

Features:

  • User listing and search
  • Filter by role, status
  • Quick edit access
  • Bulk actions

Grid Columns:

  • User Name
  • First/Last Name
  • Email
  • Role
  • Status
  • Created/Modified dates

Permission Levels

Access Levels

1. Full Access

  • All resources and actions
  • Typically for administrators
  • Unrestricted system access

2. Custom Access

  • Specific resource permissions
  • Tailored to job functions
  • Granular control

3. Read-Only Access

  • View permissions only
  • No modification capabilities
  • Audit and reporting access

Permission Scopes

1. Global Scope

  • All websites, stores, store views
  • System-wide settings
  • Global configurations

2. Website Scope

  • Specific website access
  • Multi-site restrictions
  • Website-level settings

3. Store View Scope

  • Store view specific
  • Localized content
  • Store view settings

Common User Roles

Administrator

Permissions: Full access to all resources

Typical Responsibilities:

  • System configuration
  • User management
  • Module installation
  • Server maintenance

Security Considerations:

  • Limit number of admin accounts
  • Use strong passwords
  • Enable 2FA
  • Monitor login activity

Marketing Manager

Permissions:

  • Content management (CMS pages, blocks)
  • Promotions and price rules
  • Email marketing
  • SEO settings
  • Reports and analytics

Restricted from:

  • System configuration
  • User management
  • Payment/shipping settings

Catalog Manager

Permissions:

  • Product catalog
  • Categories
  • Attributes
  • Inventory management
  • Product reviews

Restricted from:

  • Pricing (may vary)
  • System settings
  • User management

Customer Service

Permissions:

  • Customer accounts
  • Orders (view, edit, cancel)
  • Returns and refunds
  • Customer communications
  • Order shipments

Restricted from:

  • Product catalog
  • System settings
  • Financial reports

Content Editor

Permissions:

  • CMS pages and blocks
  • Page builder content
  • Media library
  • Blog posts (if applicable)

Restricted from:

  • Products and catalog
  • System configuration
  • Customer data

Analytics/Reporting

Permissions:

  • Reports (all types)
  • Analytics dashboards
  • Export capabilities

Restricted from:

  • Any write operations
  • System configuration
  • User management

Quick Start Guide

Creating Your First User

1. Navigate to User Management:

System > Permissions > All Users > Add New User

2. Fill Required Information:

  • User Name
  • First/Last Name
  • Email
  • Password (with confirmation)

3. Assign Role:

  • Select from existing roles
  • Or create new custom role

4. Set Additional Options:

  • Interface Locale
  • Current User Identity Verification
  • User Status (Active)

5. Save User:

  • Click "Save User"
  • Verify creation in user grid

Creating Your First Role

1. Navigate to Roles:

System > Permissions > User Roles > Add New Role

2. Role Information:

  • Role Name (descriptive)
  • Password confirmation (yours)

3. Set Role Resources:

  • Select "Custom" for Role Scopes
  • Check specific permissions

4. Save Role:

  • Click "Save Role"
  • Assign to users

Security Best Practices

Password Policies

Configure:

Stores > Configuration > Advanced > Admin > Security

Settings:

  • Password Lifetime: 90 days recommended
  • Password Change: Force change on first login
  • Lockout Time: 30 minutes after failed attempts
  • Maximum Login Failures: 3-5 attempts
  • Minimum Password Length: 12+ characters
  • Required Character Types: Numbers, symbols, mixed case

Two-Factor Authentication (2FA)

Enable 2FA:

Stores > Configuration > Security > 2FA

Supported Methods:

  • Google Authenticator
  • Duo Security
  • Authy
  • U2F (hardware keys)

Force 2FA for all admin users:

php bin/magento security:tfa:google:set-secret admin@example.com [SECRET]

Session Management

Configure:

Stores > Configuration > Advanced > Admin > Security

Settings:

  • Session Lifetime: 900 seconds (15 min) for high security
  • Max Session Size: Limit to prevent memory issues
  • Session Validation:
    • Validate HTTP_USER_AGENT
    • Validate REMOTE_ADDR

Admin URL Customization

Change default admin URL:

File: app/etc/env.php

'backend' => [
    'frontName' => 'custom_admin_url'  // Change from 'admin'
]

Or via CLI:

php bin/magento setup:config:set --backend-frontname="custom_admin_url"

IP Whitelisting

Restrict admin access by IP:

.htaccess method:

<Files "index.php">
    Order deny,allow
    Deny from all
    Allow from 123.456.789.0
    Allow from 98.765.432.0
</Files>

Nginx method:

location /admin {
    allow 123.456.789.0;
    allow 98.765.432.0;
    deny all;
}

Audit and Monitoring

Action Logs

Enable admin actions logging:

Stores > Configuration > Advanced > Admin > Admin Actions Log Archiving

View logs:

System > Action Logs > Report
System > Action Logs > Archive

Logged actions:

  • User login/logout
  • Password changes
  • Configuration changes
  • Product modifications
  • Order updates

Login Monitoring

Check login attempts:

# View admin login logs
grep "admin" var/log/system.log | grep "login"

Database query:

SELECT * FROM admin_user WHERE lognum > 5;  -- Users with multiple failed logins

User Activity Reports

CLI command:

php bin/magento admin:user:list

Database queries:

-- Last login times
SELECT username, email, logdate, lognum
FROM admin_user
ORDER BY logdate DESC;

-- Currently locked accounts
SELECT username, email, failures_num, first_failure, lock_expires
FROM admin_user
WHERE lock_expires > NOW();

API Access Management

Creating API User

1. Create Integration:

System > Extensions > Integrations > Add New Integration

2. Configure:

  • Name
  • Email (for notifications)
  • Callback URL (for OAuth)
  • Identity Link URL

3. Set API Permissions:

  • Select resource access
  • Can mirror role permissions

4. Activate:

  • Save and activate
  • Store access tokens securely

Token-Based Authentication

Generate admin token:

curl -X POST "https://your-store.com/rest/V1/integration/admin/token" \
     -H "Content-Type: application/json" \
     -d '{"username":"admin","password":"password123"}'

Use token:

curl -X GET "https://your-store.com/rest/V1/products/SKU123" \
     -H "Authorization: Bearer <token>"

Troubleshooting

Locked Out of Admin

Reset via CLI:

# Create new admin user
php bin/magento admin:user:create \
    --admin-user="recovery_admin" \
    --admin-password="NewPassword123!" \
    --admin-email="admin@example.com" \
    --admin-firstname="Recovery" \
    --admin-lastname="Admin"

Reset password:

php bin/magento admin:user:unlock admin_username

Forgot Admin URL

Check current admin URL:

php bin/magento info:adminuri

Permission Issues

Clear ACL cache:

php bin/magento cache:clean config
php bin/magento cache:clean

Reindex permissions:

php bin/magento indexer:reindex

Advanced Topics

Custom ACL Resources

Define custom resource:

File: etc/acl.xml

<?xml version="1.0"?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
    <acl>
        <resources>
            <resource id="Magento_Backend::admin">
                <resource id="Vendor_Module::resource" title="Custom Resource" sortOrder="10">
                    <resource id="Vendor_Module::manage" title="Manage Items" sortOrder="10"/>
                    <resource id="Vendor_Module::view" title="View Items" sortOrder="20"/>
                </resource>
            </resource>
        </resources>
    </acl>
</config>

Programmatic User Management

Create user via code:

<?php
use Magento\User\Model\UserFactory;
use Magento\Authorization\Model\RoleFactory;

class UserCreator
{
    protected $userFactory;
    protected $roleFactory;

    public function createUser($data)
    {
        $user = $this->userFactory->create();
        $user->setData([
            'username' => $data['username'],
            'firstname' => $data['firstname'],
            'lastname' => $data['lastname'],
            'email' => $data['email'],
            'password' => $data['password'],
            'is_active' => 1
        ]);
        $user->save();

        return $user;
    }
}

Compliance and Regulations

GDPR Considerations

User data handling:

  • Store minimum required user data
  • Implement data retention policies
  • Enable audit logging
  • Provide data export capabilities

Admin user rights:

  • Right to access
  • Right to rectification
  • Right to erasure

PCI DSS Compliance

Requirements:

  • Strong password policies
  • 2FA for all users
  • Session timeout enforcement
  • Activity logging
  • Regular access reviews

Next Steps

Explore detailed user management guides:

Additional Resources

Back to top