In the admin_role table there is a column role_type that can have 2 values:

  • 'G' - Mage_Admin_Model_Acl::ROLE_TYPE_GROUP
  • 'U' - Mage_Admin_Model_Acl::ROLE_TYPE_USER

By their names I jump do the conclusion that one is for user roles, and the other is for group roles but I cannot understand how are these values used.
AFAIK each admin user, in order to have access to some admin areas must have a role. Is that role 'the group'? If yes, then what is the use of the U value. If not, what's 'the group' then?

Magento version is not important. It's been there since the "big bang" (v0.7) and it's even ported in the next universe (Magento 2).

3 Answers 3


Yes, the that is 'the group'. Each user has a User Role which has a parent of a Group Role, all users are assigned to a group via the parent_id in that table.

The only real value I can see is in the acl generation where they can dump in the whole table and generate the acl structure based on the information provided, in Mage_Admin_Model_Resource_Acl::loadRoles

public function loadRoles(Mage_Admin_Model_Acl $acl, array $rolesArr)
    foreach ($rolesArr as $role) {
        $parent = ($role['parent_id'] > 0) ? Mage_Admin_Model_Acl::ROLE_TYPE_GROUP . $role['parent_id'] : null;
        switch ($role['role_type']) {
            case Mage_Admin_Model_Acl::ROLE_TYPE_GROUP:
                $roleId = $role['role_type'] . $role['role_id'];
                $acl->addRole(Mage::getModel('admin/acl_role_group', $roleId), $parent);

            case Mage_Admin_Model_Acl::ROLE_TYPE_USER:
                $roleId = $role['role_type'] . $role['user_id'];
                if (!$acl->hasRole($roleId)) {
                    $acl->addRole(Mage::getModel('admin/acl_role_user', $roleId), $parent);
                } else {
                    $acl->addRoleParent($roleId, $parent);

    return $this;

It looks like they could have used ($role['parent_id'] > 0) to determine whether it is a group or user role, but I guess that is quite error prone.


In short: What you call "the role" is the group (like "Administrators").

Each group has an entry with the type G and each user has an entry with the type U which refers to the user's group via parent_id. All access rules are defined at group level. If you look at the table admin_rules, you will see that all entries have G as role type.

The admin_rule.role_type feature seems to be something like the stock_id, somehow intended, never fully implemented and then carried along because nobody dares to touch it.

Out of curiosity I tried to enter a dataset with role type U manually but the parent role always takes precedence, no matter if it is an allow or deny rule. And without a parent role, you don't get access to the admin panel at all.


Magento 2.x DB mysql query

SELECT au.user_id,au.username,au.firstname,au.lastname,au.email,CASE WHEN au.is_active = 1 THEN 'Enable' ELSE 'Disable' END AS Status ,au.created, au.logdate, detail_role.role_name FROM admin_user as au LEFT JOIN authorization_role as user_role ON au.user_id = user_role.user_id AND user_role.parent_id != 0 LEFT JOIN authorization_role as detail_role ON user_role.parent_id = detail_role.role_id

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.