Skip to main content

Users and roles

Several administrators and managers can work in an online store on SalesArt with Drupal Commerce. A system of user roles and permissions is used to manage access and security. This allows you to separate responsibilities and eliminate errors (for example, so that a content manager cannot accidentally delete orders).

1. User management​

All registered users are displayed in the Users section (/admin/people). Here you can:

  • view the list of accounts;
  • activate or block users;
  • edit profile data;
  • assign roles and permissions.
Example:

You have a site administrator, an order manager, and a marketer. Each of them has different access permissions.

2. Main roles in an online store​

By default, Drupal has three roles:

  • Anonymous user — guests who browse the site without registering.
  • Authenticated user — registered customers who have logged into their account.
  • Administrator — full access to all functions.

Online stores often add additional roles:

  • Trade manager — order management, payment and delivery processing.
  • Content editor — adding and editing articles, news, promotions.
  • Marketer — working with coupons, promotions, and SEO settings.
  • Wholesale customer — a special role for B2B buyers with individual discounts.
Example:

The "Trade Manager" role only has access to the "Commerce → Orders" section, but cannot change the site settings.

3. Configuring roles and permissions​

To add a new role:

  1. Go to People → Roles → Add Role.
  2. Specify a name (for example, "Trade Manager").
  3. Save.

To assign permissions:

  1. Go to People → Roles → Role name → Permissions.
  2. Check the checkboxes for the desired permissions:
    • view orders;
    • edit products;
    • access to shipping and payment settings;
    • create promotions.
  3. Save your changes. You can also do this on the People → Permissions (/admin/people/permissions). All user roles are available on this page.
Tip:

Use the principle of least privilege — give employees only the permissions they need to do their job.

4. Assigning roles to users​

To assign a role to a specific user:

  1. Open their profile (People → Edit (for the user selected in the list)).
  2. In the "Roles" section, select one or more roles.
  3. Save.
Example:

The user "John Doe" has the roles "Authenticated user" and "Wholesale customer".

5. Security recommendations​

  • Use unique logins and complex passwords for administrators.
  • Enable two-factor authentication (2FA) (you need to install the TFA module).
  • Limit the number of users with the "Administrator" role.
  • Regularly check the user list and delete inactive accounts.
  • (Optional) Enable action logging (Watchdog module or extended Security Kit).