Map User Type Profiles to Approved Joomla Groups
A User Type Profile’s most important security setting is its Joomla destination-group mapping. QCFUM 2.0.4 validates those groups before saving and again normalizes them when the Profile is used for account creation.
Choose the Minimum Groups Needed
Map each Profile to the smallest set of Joomla groups that provides the intended frontend access. Do not mirror an administrator’s own group memberships or add convenience groups “just in case.”
Current Destination-Group Limits
| Tier | Destination groups per Profile |
|---|---|
| Basic | 1 |
| Pro | 5 |
| Max / All Access | Unlimited |
Protected Groups Are Refused
When a Profile is saved, QCFUM verifies that each selected Joomla group exists and rejects groups that carry protected administrative capabilities. The current protection check covers core.admin, core.login.admin, and core.manage.
This validation prevents a Profile from becoming a delegated shortcut into Joomla backend administration.
Profile Groups Become Direct Joomla Memberships
When QCFUM creates a user, it loads the Profile’s validated group list and passes that list to Joomla’s User API in the new account data. Those selected IDs therefore become the account’s direct Joomla group memberships.
Joomla group inheritance still determines the permissions the user receives from those memberships. QCFUM does not need to add ancestor groups as duplicate direct memberships.
Configure and Test the Mapping
- Open Components > QC Frontend User Manager > Profiles.
- Edit the intended Profile.
- Select only the approved destination groups.
- Keep the number of groups within the current tier limit.
- Save the Profile.
- Create a safe test user with that Profile.
- Open the Joomla user record and verify the direct group memberships.
- Test the resulting frontend access with the new account.
If a Saved Group Later Becomes Invalid
QCFUM normalizes the Profile’s group list at runtime. Missing or protected groups are not treated as valid onboarding destinations. If normalization leaves no safe group and the standard Registered group is available and safe, QCFUM can fall back to Registered rather than creating an account with an unsafe destination.
Review After Joomla ACL Changes
A group that was appropriate when the Profile was created can gain different permissions later. Recheck Profile mappings after major Joomla group/ACL changes, not only when QCFUM itself is upgraded.
Community Discussion
Want to compare QCFUM onboarding designs, User Type Profiles, Invite Packs, or safe Joomla group mappings? Visit the QC Frontend User Manager Community. For private support, bug reports, account-specific entitlement problems, or feature requests, use the QuantaCade support system.