---
title: "Backend user API"
manual: "TYPO3 Explained"
version: "13.4"
permalink: "https://docs.typo3.org/permalink/t3coreapi:backend-user-api@13.4"
source: "ApiOverview/Authentication/BackendUsers/Index.rst"
rendered: "2026-09-23T17:02:48+00:00"
---

# Backend user API {#backend-user-api}

In TYPO3, **backend users (BE users)** are responsible for managing content,
settings, and administration tasks within the backend. They are stored in the
`be_users` database table and authenticated via the
[Backend user object](https://docs.typo3.org/permalink/t3coreapi:be-user@13.4)
stored in the global variable `$GLOBALS['BE_USER']`
(class `\TYPO3\CMS\Core\Authentication\BackendUserAuthentication`).

> [!NOTE]
> **See also**
>
> -   How to create and manage backend users:
>     [Backend user management](https://docs.typo3.org/permalink/t3coreapi:user-management@13.4).
> -   [Security Guide: Users and access privileges](https://docs.typo3.org/permalink/t3coreapi:security-access-privileges@13.4).
> -   [Backend user object](https://docs.typo3.org/permalink/t3coreapi:be-user@13.4)
> -   [Access control in the backend (users and groups)](https://docs.typo3.org/permalink/t3coreapi:access@13.4)
> -   [User settings configuration](https://docs.typo3.org/permalink/t3coreapi:user-settings@13.4)
> -   [Be.security.ifAuthenticated ViewHelper \<f:be.security.ifAuthenticated>](https://docs.typo3.org/other/typo3/view-helper-reference/13.4/en-us/Global/Be/Security/IfAuthenticated.html#typo3-fluid-be-security-ifauthenticated)
> -   [Be.security.ifHasRole ViewHelper \<f:be.security.ifHasRole>](https://docs.typo3.org/other/typo3/view-helper-reference/13.4/en-us/Global/Be/Security/IfHasRole.html#typo3-fluid-be-security-ifhasrole)
> -   [TypoScript condition \[backend.user.isLoggedIn\]](https://docs.typo3.org/m/typo3/reference-typoscript/13.4/en-us/Conditions/Index.html#condition-backend-user-isLoggedIn)

## Sudo mode (step-up authentication) for password changes {#backend-user-api-sudo}

<!-- TODO: no Markdown rendering for "versionadded" -->

This functionality was introduced in response to security advisory TYPO3-CORE-SA-2025-013
to mitigate password-change risks.

This mechanism prevents unauthorized password changes if an administrator
session is hijacked or left unattended.

When an administrator edits their own user account or changes the
password of another user via the admin interface, password confirmation
(step-up authentication) is required.

![Dialog "Verify with user password" with password prompt shown on attempting to change a password.](../../../Images/ManualScreenshots/AdminTools/SudoMode.png)

> [!NOTE]
> This may pose challenges when integrating remote single sign-on (SSO)
> providers, as these typically do not support a dedicated step-up
> authentication process.
>
> In such cases, you can use the PSR-14 events [SudoModeRequiredEvent](https://docs.typo3.org/permalink/t3coreapi:sudomoderequiredevent)
> (triggered before showing the sudo-mode verification dialog) and
> [SudoModeVerifyEvent](https://docs.typo3.org/permalink/t3coreapi:sudomodeverifyevent)
> (triggered before actually verifying the submitted password) to adapt the behavior.