User Management and Hierarchy in SAP Hybris: Employees, Customers, and User Groups

Users in Hybris : Users in SAP Commerce (Hybris) are people who interact with the system to perform tasks like managing settings in the Backoffice or engaging with the storefront.
Types of Users in Hybris:
i)Employee
ii)Customer
If we goto User Node in BackOffice we can see two users such as Employees, Customers

An Employee in Hybris is a user who manages the application and performs administrative tasks or backend operations.
Examples of employees in Hybris:asagent, admin, CustomerSupportAdministrator, WarehouseAdministrator etc

Employees in Hybris can have multiple roles.
For example:-
One employee might be an admin with complete access to the system.
Another employee might have partial access based on their role.

Customers in Hybris are users who shop on the website, performing actions like adding products to the cart, placing orders, and managing their accounts,adding products to wishlist




Open:/platform/ext/core/resources/core-items.xml

Principal Item Type:
<itemtype code="Principal" extends="GenericItem" jaloclass="de.hybris.platform.jalo.security.Principal" autocreate="true" abstract="true" generate="true">
    <attributes>
        <attribute autocreate="true" qualifier="description" type="java.lang.String" generate="true">
            <persistence type="property"/>
            <modifiers read="true" write="true" search="true" optional="true"/>
        </attribute>
        <attribute autocreate="true" qualifier="name" type="java.lang.String" generate="true">
            <persistence type="property"/>
            <modifiers read="true" write="true" search="true" optional="true"/>
        </attribute>
        <attribute autocreate="true" qualifier="uid" type="java.lang.String" generate="true">
            <persistence type="property"/>
            <modifiers read="true" write="true" search="true" optional="false" unique="true"/>
        </attribute>
    </attributes>
    <indexes>
        <index name="UID" unique="true">
            <key attribute="uid"/>
        </index>
    </indexes>
</itemtype>

User Item Type:
<itemtype code="User" extends="Principal" jaloclass="de.hybris.platform.jalo.user.User" autocreate="true" generate="true">
    <deployment table="Users" typecode="4" propertytable="UserProps"/>
    <attributes>
        <attribute autocreate="true" qualifier="currentTime" type="java.util.Date">
            <modifiers read="true" write="false" search="false" optional="false"/>
            <persistence type="dynamic"/>
        </attribute>
        <attribute autocreate="true" qualifier="currentDate" type="java.util.Date">
            <modifiers read="true" write="false" search="false" optional="false"/>
            <persistence type="dynamic"/>
        </attribute>
        <attribute autocreate="true" qualifier="defaultPaymentAddress" type="Address" isSelectionOf="addresses">
            <persistence type="property"/>
            <modifiers read="true" write="true" search="false" optional="true"/>
        </attribute>
        ..........
    </attributes>
</itemtype>

Employee Item Type:
<itemtype code="Employee" extends="User" jaloclass="de.hybris.platform.jalo.user.Employee" autocreate="true" generate="true"></itemtype>

Customer Item Type:
<itemtype code="Customer" extends="User" jaloclass="de.hybris.platform.jalo.user.Customer" autocreate="true" generate="true">
    <attributes>
        <attribute autocreate="true" qualifier="customerID" type="java.lang.String">
            <modifiers read="true" write="true" search="true" optional="true"/>
            <persistence type="property"/>
        </attribute>
    </attributes>
</itemtype>

Item Type Hierarchy

• GENERICITEM
  • PRINCIPAL
    • USER
      • CUSTOMER, EMPLOYEE

PRINCIPAL item type has a UID (Unique Identifier) that is unique for each item of this type.
USER item type extends PRINCIPAL, so it inherits the same UID from PRINCIPAL.
CUSTOMER and EMPLOYEE are both types of USER. Since CUSTOMER and EMPLOYEE are extensions of USER, they also inherit the UID from PRINCIPAL.

The UID is still unique for each CUSTOMER and EMPLOYEE because it's inherited from PRINCIPAL

What are UserGroups in Hybris :
UserGroups are a way to give users specific "powers" or permissions in Hybris. If a user belongs to a UserGroup, they inherit the rights assigned to that group.
For example, being in an admin-group allows full system access, while being in an employee-group grants standard employee privileges.This makes UserGroups a powerful and efficient way to manage user permissions in SAP Commerce (Hybris).


Open:/platform/ext/core/resources/core-items.xml

PrincipalGroup Item Type:
<itemtype code="PrincipalGroup" extends="Principal" jaloclass="de.hybris.platform.jalo.security.PrincipalGroup" abstract="true" autocreate="true" generate="true">
    <attributes>
        <attribute autocreate="true" qualifier="locName" type="localized:java.lang.String" generate="true">
            <persistence type="property"/>
            <modifiers read="true" write="true" search="true" optional="true" private="false"/>
            <custom-properties>
                <property name="hmcIndexField">
                    <value>"the field"</value>
                </property>
            </custom-properties>
            <model>
                <getter name="locname" deprecated="true" deprecatedSince="ages"/>
                <setter name="locname" deprecated="true" deprecatedSince="ages"/>
            </model>
        </attribute>

        <attribute autocreate="true" redeclare="true" qualifier="displayName" type="localized:java.lang.String" generate="true">
            <persistence type="dynamic" attributeHandler="principalGroupDisplayNameLocalizedAttributeHandler"/>
            <modifiers read="true" write="false" search="false" optional="true"/>
        </attribute>

        <attribute autocreate="true" qualifier="maxBruteForceLoginAttempts" type="java.lang.Integer" generate="true">
            <persistence type="property"/>
            <modifiers read="true" write="true" search="true" optional="true"/>
        </attribute>
    </attributes>
</itemtype>

UserGroup Item Type:
<itemtype code="UserGroup" extends="PrincipalGroup" jaloclass="de.hybris.platform.jalo.user.UserGroup" autocreate="true" generate="true">
    <deployment table="UserGroups" typecode="5" property table="UserGroupProps"/>
    <attributes>
        <attribute qualifier="writeableLanguages" type="LanguageCollection">
            <modifiers read="true" write="true" search="true" optional="true"/>
            <persistence type="property"/>
        </attribute>
        <attribute qualifier="readableLanguages" type="LanguageCollection">
            <modifiers read="true" write="true" search="true" optional="true"/>
            <persistence type="property"/>
        </attribute>
        <attribute qualifier="hmcXML" type="java.lang.String">
            <modifiers read="true" write="true" search="false" optional="true" dontOptimize="true"/>
            <persistence type="property"/>
        </attribute>
        <attribute qualifier="denyWritePermissionForAllLanguages" type="java.lang.Boolean">
            <modifiers read="true" write="true" search="false" optional="false" dontOptimize="true"/>
            <defaultvalue>java.lang.Boolean.FALSE</defaultvalue>
            <persistence type="property"/>
        </attribute>
    </attributes>
</itemtype>

Item Type Hierarchy

• GENERICITEM
  • PRINCIPAL
    • PRINCIPAL GROUP
      • USERGROUP

UID at Principal Level: The UID (Unique Identifier) at the Principal level uniquely identifies each user or employee. It is used across all roles (UserGroups) to ensure distinct identification.

UserGroups as Roles for Employees and Customers: UserGroups define roles and permissions within the system, dictating what users or employees can access and what actions they can perform. The assigned UserGroup determines the areas of SAP Commerce a user (employee or customer) can access, such as Back Office or Cockpits

<relation code="PrincipalGroupRelation" autocreate="true" generate="false" localized="false"
    deployment="de.hybris.platform.persistence.link.PrincipalGroupRelation">
    <sourceElement qualifier="members" type="Principal" collectiontype="set" cardinality="many" ordered="false">
        <modifiers read="true" write="true" search="true" optional="true"/>
    </sourceElement>
    <targetElement qualifier="groups" type="PrincipalGroup" collectiontype="set" cardinality="many" ordered="false">
        <modifiers read="true" write="true" search="true" optional="true"/>
    </targetElement>
</relation>

Employee to UserGroup: An Employee can belong to multiple UserGroups, defined by a "many" relationship where the members qualifier is associated with Principal and has a "many" cardinality.

UserGroup to Employee: A UserGroup can have multiple Employees, defined by a "many" relationship where the groups qualifier is associated with PrincipalGroup and also has a "many" cardinality.