Users can update their email and user name in a form (Form API) in a custom module. The reason is it also updates an external service.

It works well but I’ve noticed an error during our test if a user enter an existing email (which is forbidden).

So I’ve added a validation $user->validate()

Now, I have this error message :

Your current password is missing or incorrect; it's required to change the email/.

I don’t know how to proceed. Should I retrieve the user password and send it again $user->setPassword($password); ? I've search on SO, Drupal Doc, etc. but I didn't find the correct way to do this.

Here is my code :

$uid = \Drupal::currentUser()->id();

// Get user storage object.
$user_storage = \Drupal::entityManager()->getStorage('user');

// Load user by their user ID
$user = $user_storage->load($uid);

 * Validation API
 * https://www.drupal.org/docs/8/api/entity-validation-api/entity-validation-api-overview
  // Update email

  // Update username

  $violations_user = $user->validate();
  if ($violations_user->count() > 0) {
       $violation = $violations_user[0];
       drupal_set_message($violation->getMessage(), 'warning');
       // Here is the message "Your current password is missing or incorrect"
  } else {

  • Just to add use entityTypeManager instead of entityManager Jul 25, 2020 at 18:36
  • @miststudent2011Can you explain what you mean by use entityTypeManager instead of entityManager ? Why should I do this ? Thanks. Aug 17, 2020 at 14:46
  • 1
    @Sebasstien entityManager is deprecated and replaced with entityTypeManager drupal.org/project/drupal/issues/2782833 , I can not find the exact change record but the url is relevant. Aug 17, 2020 at 15:34

1 Answer 1


The violations you're seeing come from core's ProtectedUserFieldConstraint. The constraint is applied when the current user tries to update their account fields without supplying a password. The validator method has a built-in flag to disable this check when needed (e.g. when a user resets their password).

To set the flag, set the _skipProtectedUserFieldConstraint to TRUE (e.g. $user->_skipProtectedUserFieldConstraint = TRUE;) and the validator won't enforce supplying a password when changing the current user fields.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.