User Management

LaraDashboard provides comprehensive user management with role-based access control (RBAC), allowing you to manage team members, assign permissions, and control access to features.

User Overview#

Accessing User Management#

Navigate to Users in the sidebar to access:

• All Users - View and manage all users
• Add New - Create a new user
• Roles & Permissions - Manage access control

User List Features#

The user list provides:

Feature	Description
Search	Search by name or email
Filter	Filter by role, status
Sort	Sort by any column
Bulk Actions	Delete multiple users
Pagination	Configurable items per page

Creating Users#

Via Admin Panel#

1. Navigate to Users → Add New
2. Fill in required fields:

First Name: John
Last Name: Doe
Email: john@example.com
Password: ********
Confirm Password: ********
Role: Select role

3. Optional fields:

   • Profile photo
   • Phone number
   • Bio/Description
   • Custom fields (if configured)

4. Click Create User

User Options#

Option	Description
Send Welcome Email	Email credentials to user
Require Password Change	Force password reset on first login
Email Verified	Mark email as pre-verified

Validation Rules#

• Email - Must be unique and valid format
• Password - 6 to 72 characters when an admin creates or edits a user (self-registration requires at least 8). Must be confirmed.
• First/Last Name - Required, up to 50 characters each

Why 72? Passwords are hashed with bcrypt, which only reads the first 72 bytes, so longer passwords add no security. Since v1.5.1, registration, password reset, profile updates, admin user create/edit and the install wizard reject passwords over 72 characters. The login form still accepts up to 255 characters so older accounts with longer passwords can sign in.

Editing Users#

Access User Edit#

1. Go to Users → All Users
2. Click on a user name, or
3. Click Edit in the actions dropdown

Editable Fields#

• Personal information (name, email)
• Password (optional update)
• Role assignment
• Profile photo
• Additional metadata

Password Updates#

When updating passwords:

• Leave password fields empty to keep existing
• Enter new password in both fields to change
• User will be notified if email notification is enabled

User Profiles#

Profile Information#

Each user has:

• Avatar - Profile photo with Gravatar fallback
• Personal Info - Name, email, bio
• Role & Permissions - Assigned role
• Activity - Login history, recent actions
• Metadata - Custom fields

User Metadata#

Store additional information using the user_meta system:

// Store metadata
$user->setMeta('department', 'Engineering');
$user->setMeta('employee_id', 'EMP001');

// Retrieve metadata
$department = $user->getMeta('department');

Role Management#

Default Roles#

LaraDashboard includes these default roles:

Role	Description	Typical Permissions
Superadmin	Full system access	Everything
Admin	Administrative access	Users, Content, Settings (cannot delete users by default)
Editor	Content management	Blog create/view/edit, translations
Subscriber	Basic access	Dashboard, profile
Contact	CRM contact role	Dashboard, profile

Creating Roles#

1. Navigate to Users → Roles & Permissions
2. Click Add New Role
3. Enter role details:

Name: Content Manager
Description: Manages all published content

4. Select permissions
5. Click Create Role

Editing Roles#

1. Go to Roles & Permissions
2. Click on the role name
3. Modify name, description, or permissions
4. Click Update Role

Warning: Modifying roles affects all users with that role immediately.

Deleting Roles#

1. Ensure no users are assigned to the role
2. Click Delete on the role
3. Confirm deletion

Note: System roles (Superadmin) cannot be deleted.

Permission System#

Permission Structure#

Permissions follow a hierarchical structure:

users
├── users.view
├── users.create
├── users.edit
├── users.delete
└── users.edit_own

posts
├── posts.view
├── posts.create
├── posts.edit
├── posts.delete
├── posts.edit_own
└── posts.publish

settings
├── settings.view
└── settings.edit

modules
├── modules.view
├── modules.install
└── modules.delete

Permission Groups#

Permissions are organized into groups:

Group	Description
Users	User management permissions
Roles	Role management permissions
Posts	Content management
Pages	Page management
Media	Media library access
Settings	System configuration
Modules	Module management

Assigning Permissions#

To Roles#

1. Edit the role
2. Check/uncheck permissions
3. Save changes

Directly to Users#

// In code, for special cases
$user->givePermissionTo('posts.publish');
$user->revokePermissionTo('posts.delete');

Checking Permissions#

In controllers and views:

// In controller
if ($user->can('posts.create')) {
    // Allow action
}

// In Blade template
@can('posts.create')
    <button>Create Post</button>
@endcan

User Impersonation#

What is Impersonation?#

Impersonation allows administrators to log in as another user without knowing their password. Useful for:

• Debugging user-specific issues
• Verifying permissions
• Providing support

How to Impersonate#

1. Go to Users → All Users
2. Find the target user
3. Click Actions → Login As
4. You're now logged in as that user

Switching Back#

When impersonating, you'll see a banner:

You are currently logged in as John Doe. [Switch Back]

Click Switch Back to return to your account.

Impersonation Restrictions#

• Only users with user.login_as permission can impersonate (typically Superadmin)
• Cannot impersonate other Superadmin users
• All impersonation sessions are logged
• Original session is preserved

Audit Trail#

Impersonation events are logged:

[2024-01-15 10:30:00] Admin (admin@example.com) started impersonating User (user@example.com)
[2024-01-15 10:35:00] Admin (admin@example.com) stopped impersonating User (user@example.com)

Bulk Operations#

Selecting Users#

• Click checkbox to select individual users
• Click header checkbox to select all on page
• Use shift+click to select range

Available Bulk Actions#

Action	Description
Delete	Remove selected users
Change Role	Assign new role to selected
Export	Download user data
Send Email	Email selected users

Performing Bulk Actions#

1. Select users
2. Choose action from dropdown
3. Click Apply
4. Confirm action

User Activity#

Activity Logging#

All user actions are logged:

• Login/logout events
• Content changes
• Setting modifications
• Permission changes

Viewing Activity#

1. Navigate to user profile
2. Click Activity tab
3. View chronological action list

Activity Details#

Each log entry shows:

• Action type (created, updated, deleted)
• Affected resource
• Timestamp
• IP address (if configured)

Email Verification#

Enabling Verification#

Email verification is controlled in settings:

1. Go to Settings → Authentication
2. Enable Require Email Verification
3. Save settings

Verification Flow#

1. User registers or is created
2. Verification email is sent
3. User clicks verification link
4. Account is activated

Resending Verification#

Users can resend verification emails:

1. Login attempt shows verification notice
2. Click Resend Verification Email
3. Check inbox for new email

Admin Override#

Admins can manually verify users:

1. Edit user
2. Check Email Verified
3. Save user

Password Management#

Password Requirements#

Default requirements:

• Minimum 8 characters
• Configurable complexity rules

Password Reset#

User-Initiated#

1. Click Forgot Password on login
2. Enter email address
3. Receive reset link via email
4. Set new password

Admin-Initiated#

1. Edit user
2. Enter new password
3. Optionally send notification
4. Save user

Force Password Change#

Require password change on next login:

1. Edit user
2. Enable Require Password Change
3. Save user

User Export#

Exporting User Data#

1. Go to Users → All Users
2. Click Export button
3. Select format (CSV, Excel, PDF)
4. Choose fields to include
5. Download file

GDPR Compliance#

For individual user data export:

1. View user profile
2. Click Export Data
3. Download complete user data package

Troubleshooting#

User Cannot Login#

1. Check if account is active
2. Verify email is confirmed (if required)
3. Reset password
4. Check for IP restrictions

Permission Issues#

1. Verify user's role
2. Check role's permissions
3. Clear permission cache:

   php artisan permission:cache-reset
   

Missing Users#

1. Check filters (role, status)
2. Search by email directly
3. Check soft deletes (if enabled)

Best Practices#

Security#

• Use strong password requirements
• Enable email verification
• Review permissions regularly
• Monitor login activity
• Enable 2FA (if available)

Organization#

• Use meaningful role names
• Document custom permissions
• Regularly audit user access
• Remove inactive accounts

Performance#

• Paginate large user lists
• Cache permission checks
• Index searchable fields

Next Steps#

• Content Management - Manage posts and pages
• Media Library - Upload and manage files
• Settings - Configure system settings