diff --git a/news/3953.breaking.2 b/news/3953.breaking.2
new file mode 100644
index 00000000..7cccb4ea
--- /dev/null
+++ b/news/3953.breaking.2
@@ -0,0 +1,2 @@
+Move ``plone.app.users`` template/views to ``plone.app.layout.views.users``
+[tlotze]
diff --git a/setup.py b/setup.py
index 21ced550..3f0893f6 100644
--- a/setup.py
+++ b/setup.py
@@ -47,6 +47,7 @@
         "plone.app.registry",
         "plone.app.relationfield",
         "plone.app.workflow",
+        "plone.app.users",
         "plone.app.uuid",
         "plone.app.viewletmanager >=1.2",
         "plone.autoform",
@@ -57,6 +58,9 @@
         "plone.memoize",
         "plone.portlets",
         "plone.protect",
+        "plone.schemaeditor",
+        "plone.supermodel",
+        "plone.z3cform",
         "Products.CMFEditions >=1.2.2",
         "Products.GenericSetup",
         "Products.statusmessages",
diff --git a/src/plone/app/layout/tests/test_member_search.py b/src/plone/app/layout/tests/test_member_search.py
new file mode 100644
index 00000000..7b1a5a49
--- /dev/null
+++ b/src/plone/app/layout/tests/test_member_search.py
@@ -0,0 +1,17 @@
+from plone.app.layout.users.membersearch import extractCriteriaFromRequest
+
+import unittest
+
+
+class TestMemberSearch(unittest.TestCase):
+    def test_extract_criteria_from_request(self):
+        data = {
+            "_authenticator": "ab4731...",
+            "form.buttons.search": "Search",
+            "form.widgets.something": "any form value",
+            "form.widgets.roles-empty-marker": True,
+        }
+
+        result = extractCriteriaFromRequest(data)
+
+        self.assertEqual(result, {"something": "any form value"})
diff --git a/src/plone/app/layout/tests/test_user_data_panel.py b/src/plone/app/layout/tests/test_user_data_panel.py
new file mode 100644
index 00000000..782e8fbd
--- /dev/null
+++ b/src/plone/app/layout/tests/test_user_data_panel.py
@@ -0,0 +1,25 @@
+from plone.app.layout.users.userdatapanel import UserDataPanel
+from plone.app.users.tests.base import BaseTestCase
+from zExceptions import NotFound
+from zope.i18n import translate
+
+
+class TestUserDataPanel(BaseTestCase):
+    def test_regression(self):
+        portal = self.layer["portal"]
+        request = self.layer["request"]
+        request.form.update({"userid": "admin"})
+        form = UserDataPanel(portal, request)
+        description = translate(form.description, context=request)
+        self.assertTrue("admin" in description)
+        # form can be called without raising exception.
+        self.assertTrue(form())
+
+    def test_escape_html(self):
+        portal = self.layer["portal"]
+        request = self.layer["request"]
+        request.form.update({"userid": 'admin<script>alert("userid")</script>'})
+        form = UserDataPanel(portal, request)
+        description = translate(form.description, context=request)
+        self.assertTrue("<script>" not in description)
+        self.assertRaises(NotFound, form)
diff --git a/src/plone/app/layout/users/__init__py b/src/plone/app/layout/users/__init__.py
similarity index 100%
rename from src/plone/app/layout/users/__init__py
rename to src/plone/app/layout/users/__init__.py
diff --git a/src/plone/app/layout/users/account-configlet.pt b/src/plone/app/layout/users/account-configlet.pt
new file mode 100644
index 00000000..dcd0585f
--- /dev/null
+++ b/src/plone/app/layout/users/account-configlet.pt
@@ -0,0 +1,61 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+      xmlns:i18n="http://xml.zope.org/namespaces/i18n"
+      xmlns:metal="http://xml.zope.org/namespaces/metal"
+      xmlns:tal="http://xml.zope.org/namespaces/tal"
+      lang="en"
+      metal:use-macro="here/prefs_main_template/macros/master"
+      xml:lang="en"
+      i18n:domain="plone"
+>
+
+  <div metal:fill-slot="prefs_configlet_main">
+    <header>
+      <h1 class="documentFirstHeading"
+          i18n:translate=""
+      >User Details</h1>
+      <div>
+        <a class="mt-n2"
+           href="${portal_url}/@@usergroup-userprefs"
+           i18n:translate="label_go_to_users"
+        >Up to List of Users</a>
+      </div>
+      <div metal:use-macro="context/global_statusmessage/macros/portal_message">
+      Portal status message
+      </div>
+    </header>
+    <article id="user-content">
+      <div id="content-core">
+        <p class="lead mt-4">${python:view.description}</p>
+        <nav class="nav nav-tabs mb-2"
+             tal:define="
+               userquery python:view.makeQuery();
+             "
+        >
+          <li class="nav-item">
+            <a class="nav-link ${python:'active' if getattr(view, 'tab', None)=='userdata' else ''}"
+               href="${portal_url}/@@user-information${userquery}"
+               i18n:translate="title_personal_information_form"
+            >Personal Information</a>
+          </li>
+          <li class="nav-item">
+            <a class="nav-link ${python:'active' if getattr(view, 'tab', None)=='userprefs' else ''}"
+               href="${portal_url}/@@user-preferences${userquery}"
+               i18n:translate=""
+            >Personal Preferences</a>
+          </li>
+          <li class="nav-item">
+            <a class="nav-link"
+               href="${portal_url}/@@usergroup-usermembership${userquery}"
+               i18n:translate="label_group_memberships"
+            >Group Memberships</a>
+          </li>
+        </nav>
+        <metal:b use-macro="context/@@ploneform-macros/titlelessform" />
+
+      </div>
+
+    </article>
+
+  </div>
+
+</html>
diff --git a/src/plone/app/layout/users/account-panel.pt b/src/plone/app/layout/users/account-panel.pt
new file mode 100644
index 00000000..ab4de866
--- /dev/null
+++ b/src/plone/app/layout/users/account-panel.pt
@@ -0,0 +1,46 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+      xmlns:i18n="http://xml.zope.org/namespaces/i18n"
+      xmlns:metal="http://xml.zope.org/namespaces/metal"
+      xmlns:tal="http://xml.zope.org/namespaces/tal"
+      metal:use-macro="context/main_template/macros/master"
+      i18n:domain="plone"
+>
+
+  <metal:b fill-slot="content-title">
+    <h1 class="documentFirstHeading">${view/label}</h1>
+  </metal:b>
+
+  <metal:b fill-slot="content-description">
+    <p class="lead">${view/description}</p>
+  </metal:b>
+
+  <metal:b fill-slot="content-core">
+    <div class="autotabs">
+      <nav class="autotoc-nav mb-3"
+           tal:define="
+             view_actions view/prepareObjectTabs;
+           "
+      >
+        <ul class="nav nav-tabs">
+          <li class="nav-item"
+              tal:repeat="action view_actions"
+          >
+            <a id="contentview-${action/id}"
+               href="${action/url}"
+               tal:define="
+                 selected action/selected|nothing;
+               "
+               tal:attributes="
+                 class python:'autotoc-level-1' + (' nav-link active' if selected else ' nav-link');
+               "
+               i18n:translate=""
+            >${action/title}</a>
+          </li>
+        </ul>
+      </nav>
+
+      <metal:b use-macro="context/@@ploneform-macros/titlelessform" />
+    </div>
+  </metal:b>
+
+</html>
diff --git a/src/plone/app/layout/users/account.py b/src/plone/app/layout/users/account.py
new file mode 100644
index 00000000..83bbbc19
--- /dev/null
+++ b/src/plone/app/layout/users/account.py
@@ -0,0 +1,187 @@
+from plone.app.users.browser.account import AccountPanelValidation
+from plone.app.users.browser.interfaces import IAccountPanelForm
+from plone.app.users.utils import notifyWidgetActionExecutionError
+from plone.autoform.form import AutoExtensibleForm
+from plone.base import PloneMessageFactory as _
+from plone.protect import CheckAuthenticator
+from Products.CMFCore.utils import getToolByName
+from Products.CMFPlone.controlpanel.events import ConfigurationChangedEvent
+from Products.Five.browser.pagetemplatefile import ViewPageTemplateFile
+from Products.statusmessages.interfaces import IStatusMessage
+from z3c.form import button
+from z3c.form import form
+from zope.cachedescriptors.property import Lazy as lazy_property
+from zope.component import getMultiAdapter
+from zope.event import notify
+from zope.interface import implementer
+from ZTUtils import make_query
+
+
+@implementer(IAccountPanelForm)
+class AccountPanelForm(AutoExtensibleForm, form.Form, AccountPanelValidation):
+    """A simple form to be used as a basis for account panel screens."""
+
+    schema = IAccountPanelForm
+    template = ViewPageTemplateFile("account-panel.pt")
+    enableCSRFProtection = True
+
+    hidden_widgets = []
+    successMessage = _("Changes saved.")
+    noChangesMessage = _("No changes made.")
+
+    @lazy_property
+    def member(self):
+        mtool = getToolByName(self.context, "portal_membership")
+        if self.request.get("userid"):
+            return mtool.getMemberById(self.request.get("userid"))
+
+    @property
+    def label(self):
+        return self.member.getProperty("fullname") or self.member.getUserName()
+
+    def _differentEmail(self, email):
+        """Check if the submitted form email address differs from the existing
+        one.
+
+        Keeping your email the same (which happens when you change something
+        else on the personalize form) or changing it back to your login name,
+        is fine.
+
+        So: we only return True if it is *really* a different email.
+        """
+        member = self.member
+        if email in (member.getId(), member.getUserName()):
+            return False
+        # By default, PAS transforms login names to lowercase, at least when
+        # email-as-login is used.  So compare the transformed/normalized names.
+        pas = getToolByName(self.context, "acl_users")
+        email_normalized = pas.applyTransform(email)
+        # The user name should already have been normalized, but let's make sure.
+        login_normalized = pas.applyTransform(member.getUserName())
+        return email_normalized != login_normalized
+
+    def makeQuery(self):
+        userid = self.request.form.get("userid", None)
+        if userid is not None:
+            return "?{}".format(make_query({"userid": userid}))
+        return ""
+
+    def action(self):
+        return self.request.getURL() + self.makeQuery()
+
+    def validate_email(self, action, data):
+        error_keys = [error.field.getName() for error in action.form.widgets.errors]
+        if "email" in error_keys:
+            # There is already a validation error for email,
+            # so there is no need for further validation.
+            return
+        err_str = super().validate_email(data)
+        if err_str:
+            notifyWidgetActionExecutionError(action, "email", err_str)
+
+    def validate_portrait(self, action, data):
+        """Portrait validation.
+        Checks if image is supported by Pillow.
+        SVG files are not yet supported.
+        """
+        error_keys = [error.field.getName() for error in action.form.widgets.errors]
+        if "portrait" in error_keys:
+            return
+        err_str = super().validate_portrait(data)
+        if err_str:
+            notifyWidgetActionExecutionError(action, "portrait", err_str)
+
+    @button.buttonAndHandler(_("Save"))
+    def handleSave(self, action):
+        CheckAuthenticator(self.request)
+        data, errors = self.extractData()
+
+        # Extra validation for email, when it is there.  email is not in the
+        # data when you are at the personal-preferences page.
+        if "email" in data:
+            self.validate_email(action, data)
+
+        # Validate portrait, upload image could be not supported
+        # by PIL what raises an exception when scaling image.
+        if "portrait" in data:
+            self.validate_portrait(action, data)
+
+        if action.form.widgets.errors:
+            self.status = self.formErrorsMessage
+            return
+        if self.applyChanges(data):
+            IStatusMessage(self.request).addStatusMessage(
+                self.successMessage, type="info"
+            )
+            notify(ConfigurationChangedEvent(self, data))
+            self._on_save(data)
+        else:
+            IStatusMessage(self.request).addStatusMessage(
+                self.noChangesMessage, type="info"
+            )
+        self.request.response.redirect(self.action())
+
+    def updateActions(self):
+        super().updateActions()
+        if self.actions and "save" in self.actions:
+            self.actions["save"].addClass("btn btn-primary")
+
+    @button.buttonAndHandler(_("Cancel"))
+    def cancel(self, action):
+        IStatusMessage(self.request).addStatusMessage(
+            _("Changes canceled."), type="info"
+        )
+        self.request.response.redirect(
+            "{}{}".format(self.request["ACTUAL_URL"], self.makeQuery())
+        )
+
+    def _on_save(self, data=None):
+        pass
+
+    def prepareObjectTabs(self, default_tab="view", sort_first=["folderContents"]):
+        context = self.context
+        mt = getToolByName(context, "portal_membership")
+        tabs = []
+        navigation_root_url = context.absolute_url()
+
+        def _check_allowed(context, request, name):
+            """Check, if user has required permissions on view."""
+            view = getMultiAdapter((context, request), name=name)
+            allowed = True
+            for perm in view.__ac_permissions__:
+                allowed = allowed and mt.checkPermission(perm[0], context)
+            return allowed
+
+        if _check_allowed(context, self.request, "personal-information"):
+            tabs.append(
+                {
+                    "title": _(
+                        "title_personal_information_form", "Personal Information"
+                    ),
+                    "url": navigation_root_url + "/@@personal-information",
+                    "selected": (self.__name__ == "personal-information"),
+                    "id": "user_data-personal-information",
+                }
+            )
+
+        if _check_allowed(context, self.request, "personal-preferences"):
+            tabs.append(
+                {
+                    "title": _("Personal Preferences"),
+                    "url": navigation_root_url + "/@@personal-preferences",
+                    "selected": (self.__name__ == "personal-preferences"),
+                    "id": "user_data-personal-preferences",
+                }
+            )
+
+        member = mt.getAuthenticatedMember()
+        if member.canPasswordSet():
+            tabs.append(
+                {
+                    "title": _("label_password", "Password"),
+                    "url": navigation_root_url + "/@@change-password",
+                    "selected": (self.__name__ == "change-password"),
+                    "id": "user_data-change-password",
+                }
+            )
+        return tabs
diff --git a/src/plone/app/layout/users/configure.zcml b/src/plone/app/layout/users/configure.zcml
index ecacd150..d9d1ff0f 100644
--- a/src/plone/app/layout/users/configure.zcml
+++ b/src/plone/app/layout/users/configure.zcml
@@ -1,7 +1,103 @@
 <configure
     xmlns="http://namespaces.zope.org/zope"
     xmlns:browser="http://namespaces.zope.org/browser"
-    xmlns:zcml="http://namespaces.zope.org/zcml"
     >
 
+  <include package="plone.autoform" />
+  <include
+      package="Products.CMFPlone.controlpanel"
+      file="permissions.zcml"
+      />
+
+  <browser:page
+      name="register"
+      for="plone.base.interfaces.INavigationRoot"
+      class=".register.RegistrationForm"
+      permission="cmf.AddPortalMember"
+      />
+
+  <browser:page
+      name="registered"
+      for="plone.base.interfaces.INavigationRoot"
+      class=".register.RegisteredView"
+      template="registered.pt"
+      permission="cmf.AddPortalMember"
+      />
+
+  <browser:page
+      name="new-user"
+      for="plone.base.interfaces.INavigationRoot"
+      class=".register.AddUserForm"
+      permission="plone.app.controlpanel.UsersAndGroups"
+      />
+
+  <browser:page
+      name="change-password"
+      for="plone.base.interfaces.INavigationRoot"
+      class=".passwordpanel.PasswordPanel"
+      permission="cmf.SetOwnPassword"
+      />
+
+  <browser:page
+      name="personal-preferences"
+      for="plone.base.interfaces.INavigationRoot"
+      class=".personalpreferences.PersonalPreferencesPanel"
+      permission="cmf.SetOwnProperties"
+      />
+
+  <browser:page
+      name="user-preferences"
+      for="plone.base.interfaces.INavigationRoot"
+      class=".personalpreferences.PersonalPreferencesConfiglet"
+      permission="plone.app.controlpanel.UsersAndGroups"
+      />
+
+  <browser:page
+      name="personal-information"
+      for="plone.base.interfaces.INavigationRoot"
+      class=".userdatapanel.UserDataPanel"
+      permission="cmf.SetOwnProperties"
+      />
+
+  <browser:page
+      name="user-information"
+      for="plone.base.interfaces.INavigationRoot"
+      class=".userdatapanel.UserDataConfiglet"
+      permission="plone.app.controlpanel.UsersAndGroups"
+      />
+
+  <browser:page
+      name="member-fields"
+      for="*"
+      class=".schemaeditor.MemberSchemaContext"
+      allowed_interface="OFS.interfaces.IItem"
+      permission="plone.app.controlpanel.UsersAndGroups"
+      />
+
+  <browser:page
+      name="edit"
+      for="plone.app.users.schema.IMemberSchemaContext"
+      class=".schemaeditor.SchemaListingPage"
+      permission="plone.app.controlpanel.UsersAndGroups"
+      />
+
+  <browser:page
+      name="member-search"
+      for="*"
+      class=".membersearch.MemberSearchForm"
+      permission="zope2.View"
+      />
+
+  <adapter
+      factory="plone.app.users.browser.personalpreferences.PersonalPreferencesPanelAdapter"
+      provides=".personalpreferences.IPersonalPreferences"
+      for="plone.base.interfaces.INavigationRoot"
+      />
+
+  <adapter
+      factory=".passwordpanel.PasswordPanelAdapter"
+      provides=".passwordpanel.IPasswordSchema"
+      for="plone.base.interfaces.INavigationRoot"
+      />
+
 </configure>
diff --git a/src/plone/app/layout/users/memberregistration.pt b/src/plone/app/layout/users/memberregistration.pt
new file mode 100644
index 00000000..a2d21dea
--- /dev/null
+++ b/src/plone/app/layout/users/memberregistration.pt
@@ -0,0 +1,57 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+      xmlns:i18n="http://xml.zope.org/namespaces/i18n"
+      xmlns:metal="http://xml.zope.org/namespaces/metal"
+      xmlns:tal="http://xml.zope.org/namespaces/tal"
+      lang="en"
+      metal:use-macro="context/prefs_main_template/macros/master"
+      xml:lang="en"
+      i18n:domain="plone"
+>
+
+  <body>
+
+    <metal:main fill-slot="prefs_configlet_main">
+
+      <header>
+        <h1 class="documentFirstHeading"
+            i18n:translate=""
+        >Users and Groups</h1>
+
+        <div metal:use-macro="context/global_statusmessage/macros/portal_message">
+      Portal status message
+        </div>
+
+        <ul class="nav nav-pills">
+          <li class="nav-item">
+            <a class="nav-link active"
+               href="${portal_url}/@@usergroup-userprefs"
+               i18n:translate="label_users"
+            >Users</a>
+          </li>
+          <li class="nav-item">
+            <a class="nav-link"
+               href="${portal_url}/@@usergroup-groupprefs"
+               i18n:translate="label_groups"
+            >Groups</a>
+          </li>
+          <li class="nav-item">
+            <a class="nav-link active"
+               href="${portal_url}/@@usergroup-controlpanel"
+               i18n:translate="label_usergroup_settings"
+            >Settings</a>
+          </li>
+          <li class="nav-item">
+            <a class="nav-link"
+               href="${portal_url}/@@member-fields"
+               i18n:translate="label_member_fields"
+            >Member fields</a>
+          </li>
+        </ul>
+      </header>
+      <article id="content">
+        <metal:b use-macro="context/@@ploneform-macros/titlelessform" />
+      </article>
+
+    </metal:main>
+  </body>
+</html>
diff --git a/src/plone/app/layout/users/membersearch.py b/src/plone/app/layout/users/membersearch.py
new file mode 100644
index 00000000..0dbb3c7f
--- /dev/null
+++ b/src/plone/app/layout/users/membersearch.py
@@ -0,0 +1,138 @@
+from plone.autoform.form import AutoExtensibleForm
+from plone.base import PloneMessageFactory as _
+from plone.memoize.view import memoize
+from plone.supermodel import model
+from Products.CMFCore.permissions import ListPortalMembers
+from Products.CMFCore.utils import getToolByName
+from Products.Five.browser.pagetemplatefile import ViewPageTemplateFile
+from z3c.form import button
+from z3c.form import form
+from zope import schema
+
+
+class IMemberSearchSchema(model.Schema):
+    """Provide schema for member search."""
+
+    model.fieldset(
+        "extra",
+        label=_("legend_member_search_criteria", default="User Search Criteria"),
+        fields=["login", "email", "fullname"],
+    )
+
+    login = schema.TextLine(
+        title=_("label_name", default="Name"),
+        description=_(
+            "help_search_name", default="Find users whose login name contain"
+        ),
+        required=False,
+    )
+    email = schema.TextLine(
+        title=_("label_email", default="Email"),
+        description=_(
+            "help_search_email", default="Find users whose email address contain"
+        ),
+        required=False,
+    )
+    fullname = schema.TextLine(
+        title=_("label_fullname", default="Full Name"),
+        description=_(
+            "help_search_fullname", default="Find users whose full names contain"
+        ),
+        required=False,
+    )
+    # disabled: https://dev.plone.org/ticket/13862
+    """
+    directives.read_permission(roles='cmf.ManagePortal')
+    directives.write_permission(roles='cmf.ManagePortal')
+    directives.widget('roles', CheckBoxWidget)
+    roles = schema.List(
+        title=_(u'label_roles', default=u'Role(s)'),
+        description=_(
+            u'help_search_roles',
+            default=u'Find users with all of the selected roles.'),
+        required=False,
+        value_type=schema.Choice(
+            vocabulary='plone.app.vocabularies.Roles',
+        ),
+    )
+    """
+
+
+def extractCriteriaFromRequest(criteria):
+    """Takes a dictionary of z3c.form data and sanitizes it to fit
+    for a pas member search.
+    """
+    for key in [
+        "_authenticator",
+        "form.buttons.search",
+        "form.widgets.roles-empty-marker",
+    ]:
+        if key in criteria:
+            del criteria[key]
+    for key, value in list(criteria.items()):
+        if not value:
+            del criteria[key]
+        else:
+            new_key = key.replace("form.widgets.", "")
+            criteria[new_key] = value
+            del criteria[key]
+
+    return criteria
+
+
+class MemberSearchForm(AutoExtensibleForm, form.Form):
+    """This search form enables you to find users by specifying one or more
+    search criteria.
+    """
+
+    schema = IMemberSearchSchema
+    ignoreContext = True
+
+    label = _("heading_member_search", default="Search for users")
+    description = _(
+        "description_member_search",
+        default="This search form enables you to find users by specifying one or more search criteria.",
+    )
+    template = ViewPageTemplateFile("membersearch_form.pt")
+    enableCSRFProtection = True
+    formErrorsMessage = _("There were errors.")
+
+    submitted = False
+
+    @property
+    @memoize
+    def listing_allowed(self):
+        """
+        Check if the user has the necessary "List Portal Members" permissions
+        to view the list of search results.
+        """
+        pm = getToolByName(self.context, "portal_membership")
+        return pm.checkPermission(ListPortalMembers, self.context)
+
+    @property
+    def results(self):
+        """
+        Retrieve, merge, and sort the list of results based on search criteria.
+
+        This is based on the methods previously defined in the
+        Products.PlonePAS.browser.search module.
+        """
+        # First of all check if we have the proper permissions
+        if not self.listing_allowed:
+            return []
+
+        view = self.context.restrictedTraverse("@@pas_search")
+        criteria = extractCriteriaFromRequest(self.request.form.copy())
+        return view.searchUsers(sort_by="fullname", **criteria)
+
+    @button.buttonAndHandler(_("label_search", default="Search"), name="search")
+    def handleApply(self, action):
+        request = self.request
+        data, errors = self.extractData()
+
+        if errors:
+            self.status = self.formErrorsMessage
+            return
+
+        if request.get("form.buttons.search", None):
+            self.submitted = True
diff --git a/src/plone/app/layout/users/membersearch_form.pt b/src/plone/app/layout/users/membersearch_form.pt
new file mode 100644
index 00000000..95c24814
--- /dev/null
+++ b/src/plone/app/layout/users/membersearch_form.pt
@@ -0,0 +1,120 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+      xmlns:i18n="http://xml.zope.org/namespaces/i18n"
+      xmlns:metal="http://xml.zope.org/namespaces/metal"
+      xmlns:tal="http://xml.zope.org/namespaces/tal"
+      metal:use-macro="context/main_template/macros/master"
+      i18n:domain="plone"
+>
+
+  <body>
+    <metal:body fill-slot="body">
+
+      <article id="content"
+               tal:condition="not: view/submitted"
+      >
+        <h1 class="documentFirstHeading"
+            tal:content="view/label | nothing"
+        ></h1>
+        <div id="content-core">
+          <metal:block use-macro="context/@@ploneform-macros/titlelessform" />
+        </div>
+      </article>
+
+      <tal:block condition="view/submitted">
+        <article id="content"
+                 tal:define="
+                   listing_allowed python: view.listing_allowed;
+                   results python: view.results;
+                   Batch python:modules['Products.CMFPlone'].Batch;
+                   DateTime python:modules['DateTime'].DateTime;
+                   b_size python:12;
+                   b_start python:0;
+                   b_start request/b_start | b_start;
+                 "
+        >
+          <h1 class="documentFirstHeading"
+              i18n:translate="heading_search_results"
+          >Search results</h1>
+
+          <div id="content-core">
+            <p tal:condition="not: listing_allowed"
+               i18n:translate="member_listing_not_allowed"
+            >
+                    You are not allowed to list portal members.
+            </p>
+
+            <tal:block condition="python: results and listing_allowed">
+              <div tal:define="
+                     batch python:Batch(results, b_size, int(b_start), orphan=1);
+                   ">
+
+                <strong i18n:translate="batch_x_items_matching_your_criteria">
+                  <span tal:content="python:len(results)"
+                        tal:omit-tag=""
+                        i18n:name="number"
+                  >234</span>
+                   items matching your search terms.
+                </strong>
+
+                <div metal:use-macro="here/batch_macros/macros/navigation"></div>
+
+                <div tal:define="
+                       pm context/@@plone_tools/membership;
+                       portal_url context/@@plone_portal_state/portal_url;
+                     ">
+                  <metal:block tal:repeat="result batch">
+                    <div class="card"
+                         tal:define="
+                           userid result/userid | nothing;
+                           personal_info python:pm.getMemberInfo(userid) or {};
+                           home python:pm.getHomeUrl(userid, verifyPermission=1);
+                           portrait python:pm.getPersonalPortrait(userid);
+                         "
+                    >
+
+                      <a href="#"
+                         tal:attributes="
+                           href python:home or '%s/author/%s' % (portal_url, userid);
+                         "
+                      >
+                        <img alt=""
+                             border="0"
+                             height="100"
+                             src="defaultUser.png"
+                             width="75"
+                             tal:attributes="
+                               src portrait/absolute_url;
+                             "
+                        />
+                        <br />
+                        <span tal:content="python:personal_info.get('fullname', userid)">user id</span>
+                      </a>
+
+                    </div>
+                  </metal:block>
+                </div>
+
+                <div class="visualClear"
+                     id="clear-space-before-navigation"
+                ><!-- --></div>
+
+                <div metal:use-macro="here/batch_macros/macros/navigation"></div>
+
+                <div class="visualClear"
+                     id="clear-space-after-navigation"
+                ><!-- --></div>
+
+              </div>
+            </tal:block>
+
+            <div tal:condition="python: not results and listing_allowed">
+              <p><strong i18n:translate="description_no_results_found">No results were found.</strong></p>
+            </div>
+          </div>
+        </article>
+      </tal:block>
+
+
+    </metal:body>
+  </body>
+</html>
diff --git a/src/plone/app/layout/users/newuser_form.pt b/src/plone/app/layout/users/newuser_form.pt
new file mode 100644
index 00000000..41dd42b0
--- /dev/null
+++ b/src/plone/app/layout/users/newuser_form.pt
@@ -0,0 +1,33 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+      xmlns:i18n="http://xml.zope.org/namespaces/i18n"
+      xmlns:metal="http://xml.zope.org/namespaces/metal"
+      xmlns:tal="http://xml.zope.org/namespaces/tal"
+      metal:use-macro="context/main_template/macros/master"
+      i18n:domain="plone"
+>
+  <head>
+    <metal:block fill-slot="top_slot"
+                 tal:define="
+                   dummy python:request.set('disable_border',1);
+                   disable_column_one python:request.set('disable_plone.leftcolumn',1);
+                   disable_column_two python:request.set('disable_plone.rightcolumn',1);
+                 "
+    />
+  </head>
+
+  <body>
+    <metal:body fill-slot="body">
+
+      <article id="content">
+        <h1 class="documentFirstHeading"
+            tal:content="view/label | nothing"
+        ></h1>
+        <div id="content-core">
+          <metal:block use-macro="context/@@ploneform-macros/titlelessform">
+          </metal:block>
+        </div>
+      </article>
+
+    </metal:body>
+  </body>
+</html>
diff --git a/src/plone/app/layout/users/passwordpanel.py b/src/plone/app/layout/users/passwordpanel.py
new file mode 100644
index 00000000..b32553d1
--- /dev/null
+++ b/src/plone/app/layout/users/passwordpanel.py
@@ -0,0 +1,140 @@
+from Acquisition import aq_inner
+from plone.app.layout.users.account import AccountPanelForm
+from plone.app.users.utils import notifyWidgetActionExecutionError
+from plone.base import PloneMessageFactory as _
+from Products.CMFCore.utils import getToolByName
+from Products.statusmessages.interfaces import IStatusMessage
+from z3c.form import button
+from zope import schema
+from zope.cachedescriptors.property import Lazy as lazy_property
+from zope.interface import Interface
+
+
+class IPasswordSchema(Interface):
+    """Provide schema for password form"""
+
+    current_password = schema.Password(
+        title=_("label_current_password", default="Current password"),
+        description=_("help_current_password", default="Enter your current password."),
+        # constraint=checkCurrentPassword,
+    )
+
+    new_password = schema.Password(
+        title=_("label_new_password", default="New password"),
+        description=_("help_new_password", default="Enter your new password."),
+    )
+
+    new_password_ctl = schema.Password(
+        title=_("label_confirm_password", default="Confirm password"),
+        description=_(
+            "help_confirm_password",
+            default="Re-enter the password. Make sure the passwords are identical.",
+        ),
+    )
+
+
+class PasswordPanelAdapter:
+    def __init__(self, context):
+        self.context = getToolByName(context, "portal_membership")
+
+    def get_dummy(self):
+        """We don't actually need to 'get' anything ..."""
+        return ""
+
+    current_password = property(get_dummy)
+
+    new_password = property(get_dummy)
+
+    new_password_ctl = property(get_dummy)
+
+
+class PasswordPanel(AccountPanelForm):
+    """Implementation of password reset form that uses z3c.form."""
+
+    description = _("Change Password")
+    form_name = _("legend_password_details", default="Password Details")
+    schema = IPasswordSchema
+
+    @lazy_property
+    def member(self):
+        # Only show current username in label
+        mtool = getToolByName(self.context, "portal_membership")
+        return mtool.getAuthenticatedMember()
+
+    def updateFields(self):
+        super().updateFields()
+        # Change the password description based on PAS Plugin The user needs a
+        # list of instructions on what kind of password is required.  We'll
+        # reuse password errors as instructions e.g. "Must contain a letter and
+        # a number".  Assume PASPlugin errors are already translated
+        registration = getToolByName(self.context, "portal_registration")
+        err_str = registration.testPasswordValidity("")
+        if err_str:
+            msg = _("Enter your new password. ${errors}", mapping=dict(errors=err_str))
+            self.fields["new_password"].field.description = msg
+
+    def validate_password(self, action, data):
+        context = aq_inner(self.context)
+        registration = getToolByName(context, "portal_registration")
+        membertool = getToolByName(context, "portal_membership")
+
+        # check if password is correct
+        current_password = data.get("current_password")
+        if current_password:
+            if not membertool.testCurrentPassword(current_password):
+                # add error to current_password widget
+                err_str = _("Incorrect value for current password")
+                notifyWidgetActionExecutionError(action, "current_password", err_str)
+
+        # check if passwords are same and valid according to plugin
+        new_password = data.get("new_password")
+        new_password_ctl = data.get("new_password_ctl")
+        if new_password and new_password_ctl:
+            err_str = registration.testPasswordValidity(new_password, new_password_ctl)
+
+            if err_str:
+                # add error to new_password widget
+                notifyWidgetActionExecutionError(action, "new_password", err_str)
+                notifyWidgetActionExecutionError(action, "new_password_ctl", err_str)
+
+    @button.buttonAndHandler(
+        _("label_change_password", default="Change Password"), name="reset_passwd"
+    )
+    def action_reset_passwd(self, action):
+        data, errors = self.extractData()
+
+        # extra password validation
+        self.validate_password(action, data)
+
+        if action.form.widgets.errors:
+            self.status = self.formErrorsMessage
+            return
+
+        membertool = getToolByName(self.context, "portal_membership")
+
+        password = data["new_password"]
+
+        try:
+            membertool.setPassword(password, None, REQUEST=self.request)
+        except AttributeError:
+            failMessage = _(
+                "While changing your password an AttributeError "
+                "occurred. This is usually caused by your user "
+                "being defined outside the portal."
+            )
+
+            IStatusMessage(self.request).addStatusMessage(_(failMessage), type="error")
+            return
+
+        IStatusMessage(self.request).addStatusMessage(
+            _("Password changed"), type="info"
+        )
+
+    # hide inherited Save and Cancel buttons
+    @button.buttonAndHandler(_("Save"), condition=lambda form: False)
+    def handleSave(self, action):
+        pass
+
+    @button.buttonAndHandler(_("Cancel"), condition=lambda form: False)
+    def cancel(self, action):
+        pass
diff --git a/src/plone/app/layout/users/personalpreferences.py b/src/plone/app/layout/users/personalpreferences.py
new file mode 100644
index 00000000..d50dc2da
--- /dev/null
+++ b/src/plone/app/layout/users/personalpreferences.py
@@ -0,0 +1,49 @@
+from plone.app.layout.users.account import AccountPanelForm
+from plone.app.users.browser.personalpreferences import IPersonalPreferences
+from plone.base import PloneMessageFactory as _
+from Products.CMFCore.utils import getToolByName
+from Products.Five.browser.pagetemplatefile import ViewPageTemplateFile
+
+
+class PersonalPreferencesPanel(AccountPanelForm):
+    """Implementation of personalize form that uses z3c.form."""
+
+    form_name = _("legend_personal_details", "Personal Details")
+    schema = IPersonalPreferences
+
+    @property
+    def description(self):
+        userid = self.request.form.get("userid")
+        mt = getToolByName(self.context, "portal_membership")
+        if userid and (userid != mt.getAuthenticatedMember().getId()):
+            # editing someone else's profile
+            return _(
+                "description_preferences_form_otheruser",
+                default="Personal settings for $name",
+                mapping={"name": userid},
+            )
+        else:
+            # editing my own profile
+            return _("description_my_preferences", default="Your personal settings.")
+
+    def updateWidgets(self):
+        super().updateWidgets()
+
+        self.widgets["language"].noValueMessage = _(
+            "vocabulary-missing-single-value-for-edit",
+            "Language neutral (site default)",
+        )
+        self.widgets["wysiwyg_editor"].noValueMessage = _(
+            "vocabulary-available-editor-novalue", "Use site default"
+        )
+
+    def __call__(self):
+        self.request.set("disable_border", 1)
+        return super().__call__()
+
+
+class PersonalPreferencesConfiglet(PersonalPreferencesPanel):
+    """Control panel version of the personal preferences panel"""
+
+    template = ViewPageTemplateFile("account-configlet.pt")
+    tab = "userprefs"
diff --git a/src/plone/app/layout/users/register.py b/src/plone/app/layout/users/register.py
new file mode 100644
index 00000000..3400b9e1
--- /dev/null
+++ b/src/plone/app/layout/users/register.py
@@ -0,0 +1,572 @@
+from AccessControl import getSecurityManager
+from plone.app.users.browser.register import getRegisterSchema
+from plone.app.users.schema import IAddUserSchema
+from plone.app.users.schema import IRegisterSchema
+from plone.app.users.utils import generate_login_name as _generate_login_name
+from plone.app.users.utils import generate_user_id as _generate_user_id
+from plone.app.users.utils import notifyWidgetActionExecutionError
+from plone.autoform.form import AutoExtensibleForm
+from plone.base import PloneMessageFactory as _
+from plone.base.interfaces import ISecuritySchema
+from plone.base.interfaces import IUserGroupsSettingsSchema
+from plone.protect import CheckAuthenticator
+from plone.registry.interfaces import IRegistry
+from Products.CMFCore.interfaces import ISiteRoot
+from Products.CMFCore.permissions import ManagePortal
+from Products.CMFCore.utils import getToolByName
+from Products.Five import BrowserView
+from Products.Five.browser.pagetemplatefile import ViewPageTemplateFile
+from Products.statusmessages.interfaces import IStatusMessage
+from z3c.form import button
+from z3c.form import field
+from z3c.form import form
+from z3c.form.browser.checkbox import CheckBoxFieldWidget
+from z3c.form.interfaces import DISPLAY_MODE
+from zExceptions import Forbidden
+from ZODB.POSException import ConflictError
+from zope.component import getAdapter
+from zope.component import getMultiAdapter
+from zope.component import getUtility
+from zope.schema import getFieldNames
+
+import datetime
+import logging
+
+
+class BaseRegistrationForm(AutoExtensibleForm, form.Form):
+    """Form to be used as base for Register and Add User forms."""
+
+    label = ""
+    description = ""
+    formErrorsMessage = _("There were errors.")
+    ignoreContext = True
+    enableCSRFProtection = True
+
+    # this attribute indicates if user was successfully registered
+    _finishedRegister = False
+
+    @property
+    def schema(self):
+        return getRegisterSchema()
+
+    def _get_security_settings(self):
+        """Return security settings from the registry."""
+        registry = getUtility(IRegistry)
+        return registry.forInterface(ISecuritySchema, prefix="plone")
+
+    def render(self):
+        if self._finishedRegister:
+            return self.context.unrestrictedTraverse("registered")()
+
+        return super().render()
+
+    def updateFields(self):
+        """Fields are dynamic in this form, to be able to handle
+        different join styles.
+        """
+        settings = self._get_security_settings()
+        use_email_as_login = settings.use_email_as_login
+
+        # Finally, let autoform process the schema and any FormExtenders do
+        # their thing
+        super().updateFields()
+
+        if use_email_as_login:
+            self.fields["email"].field.description = _(
+                "help_email_creation_for_login",
+                default="Enter an email "
+                "address. This will be your login name. We respect your "
+                "privacy and will not give the address away to any third "
+                "parties or expose it anywhere.",
+            )
+            del self.fields["username"]
+        else:
+            self.fields["email"].field.description = _(
+                "help_email_creation",
+                default="Enter an email address. This is necessary in case "
+                "the password is lost. We respect your privacy and "
+                "will not give the address away to any third parties "
+                "or expose it anywhere.",
+            )
+
+        # Change the password description based on PAS Plugin The user needs a
+        # list of instructions on what kind of password is required.  We'll
+        # reuse password errors as instructions e.g. "Must contain a letter and
+        # a number".  Assume PASPlugin errors are already translated
+        if self.fields.get("password", None):
+            registration = getToolByName(self.context, "portal_registration")
+            err_str = registration.testPasswordValidity("")
+            if err_str:
+                msg = _(
+                    "help_password_creation_with_errors",
+                    default="Enter your new password. ${errors}",
+                    mapping=dict(errors=err_str),
+                )
+                self.fields["password"].field.description = msg
+
+    def updateActions(self):
+        super().updateActions()
+        self.actions["register"].addClass("btn-primary")
+
+    def generate_user_id(self, data):
+        """Generate a user id from data.
+
+        Delegates to the standalone function in plone.app.users.utils.
+        See :func:`plone.app.users.utils.generate_user_id` for details.
+        """
+        return _generate_user_id(self.context, data)
+
+    def generate_login_name(self, data):
+        """Generate a login name from data.
+
+        Delegates to the standalone function in plone.app.users.utils.
+        See :func:`plone.app.users.utils.generate_login_name` for details.
+        """
+        return _generate_login_name(self.context, data)
+
+    # Actions validators
+    def validate_registration(self, action, data):
+        """Specific business logic for this join form.  Note: all this logic
+        was taken directly from the old validate_registration.py script in
+        Products/CMFPlone/skins/plone_login/join_form_validate.vpy
+        """
+
+        # CSRF protection
+        CheckAuthenticator(self.request)
+
+        registration = getToolByName(self.context, "portal_registration")
+
+        error_keys = [error.field.getName() for error in action.form.widgets.errors]
+
+        form_field_names = [f for f in self.fields]
+
+        portal = getUtility(ISiteRoot)
+
+        # passwords should match
+        if "password" in form_field_names:
+            assert "password_ctl" in form_field_names
+            # Skip this check if password fields already have an error
+            if not ("password" in error_keys or "password_ctl" in error_keys):
+                password = data.get("password")
+                password_ctl = data.get("password_ctl")
+                if password != password_ctl:
+                    err_str = _("Passwords do not match.")
+                    notifyWidgetActionExecutionError(action, "password", err_str)
+                    notifyWidgetActionExecutionError(action, "password_ctl", err_str)
+
+        # Password field checked against RegistrationTool
+        if "password" in form_field_names:
+            # Skip this check if password fields already have an error
+            if "password" not in error_keys:
+                password = data.get("password")
+                if password:
+                    # Use PAS to test validity
+                    err_str = registration.testPasswordValidity(password)
+                    if err_str:
+                        notifyWidgetActionExecutionError(action, "password", err_str)
+
+        settings = self._get_security_settings()
+        if settings.use_email_as_login:
+            username_field = "email"
+        else:
+            username_field = "username"
+
+        # The term 'username' is not clear.  It may be the user id or
+        # the login name.  So here we try to be explicit.
+
+        # Generate a nice user id and store that in the data.
+        user_id = self.generate_user_id(data)
+        # Generate a nice login name and store that in the data.
+        login_name = self.generate_login_name(data)
+
+        # Do several checks to see if the user id and the login name
+        # are valid.
+        #
+        # Skip these checks if username was already in error list.
+        #
+        # Note that if we cannot generate a unique user id, it is not
+        # necessarily the fault of the username field, but it
+        # certainly is the most likely cause in a standard Plone
+        # setup.
+
+        # check if username is valid
+        # Skip this check if username was already in error list
+        if username_field not in error_keys:
+            # user id may not be the same as the portal id.
+            if user_id == portal.getId():
+                err_str = _(
+                    "This username is reserved. Please choose a different name."
+                )
+                notifyWidgetActionExecutionError(action, username_field, err_str)
+
+        # Check if user id is allowed by the member id pattern.
+        if username_field not in error_keys:
+            if not registration.isMemberIdAllowed(user_id):
+                err_str = _(
+                    "The login name you selected is already in use or is not valid. Please choose another."
+                )
+                notifyWidgetActionExecutionError(action, username_field, err_str)
+
+        if username_field not in error_keys:
+            # Check the uniqueness of the login name, not only when
+            # use_email_as_login is true, but always.
+            pas = getToolByName(self, "acl_users")
+            results = pas.searchUsers(name=login_name, exact_match=True)
+            if results:
+                err_str = _(
+                    "The login name you selected is already in use or is not valid. Please choose another."
+                )
+                notifyWidgetActionExecutionError(action, username_field, err_str)
+
+        if "password" in form_field_names and "password" not in error_keys:
+            # Admin can either set a password or mail the user (or both).
+            if not (data["password"] or data["mail_me"]):
+                err_str = _(
+                    "msg_no_password_no_mail_me",
+                    default="You must set a password or choose to send an email.",
+                )
+
+                # set error on password field
+                notifyWidgetActionExecutionError(action, "password", err_str)
+                notifyWidgetActionExecutionError(action, "mail_me", err_str)
+
+    @button.buttonAndHandler(_("label_register", default="Register"), name="register")
+    def action_join(self, action):
+        data, errors = self.extractData()
+
+        # extra password validation
+        self.validate_registration(action, data)
+
+        if action.form.widgets.errors:
+            self.status = self.formErrorsMessage
+            return
+
+        self.handle_join_success(data)
+
+        # XXX Return somewhere else, depending on what
+        # handle_join_success returns?
+        came_from = self.request.form.get("came_from")
+        if came_from:
+            utool = getToolByName(self.context, "portal_url")
+            if utool.isURLInPortal(came_from):
+                self.request.response.redirect(came_from)
+                return ""
+
+    def handle_join_success(self, data):
+        # portal should be acquisition wrapped, this is needed for the schema
+        # adapter below
+        portal = getToolByName(self.context, "portal_url").getPortalObject()
+        registration = getToolByName(self.context, "portal_registration")
+
+        # user_id and login_name should be in the data, but let's be safe.
+        user_id = data.get("user_id", data.get("username"))
+        login_name = data.get("login_name", data.get("username"))
+
+        # Set the username for good measure, as some code may expect
+        # it to exist and contain the user id.
+        data["username"] = user_id
+
+        # The login name may already be in the form, but not
+        # necessarily, for example when using email as login.  This is
+        # at least needed for logging in immediately when password
+        # reset is bypassed.  We need the login name here, not the
+        # user id.
+        self.request.form["form.username"] = login_name
+
+        password = data.get("password") or registration.generatePassword()
+
+        try:
+            registration.addMember(user_id, password, REQUEST=self.request)
+        except (AttributeError, ValueError) as err:
+            logging.exception(err)
+            IStatusMessage(self.request).addStatusMessage(err, type="error")
+            self._finishedRegister = False
+            return
+
+        if user_id != login_name:
+            # The user id differs from the login name.  Set the login
+            # name correctly.
+            pas = getToolByName(self.context, "acl_users")
+            pas.updateLoginName(user_id, login_name)
+
+        # set member properties
+        self.applyProperties(user_id, data)
+
+        settings = self._get_security_settings()
+        self._finishedRegister = True
+        if data.get("mail_me") or (
+            not settings.enable_user_pwd_choice and not data.get("password")
+        ):
+            # We want to validate the email address (users cannot
+            # select their own passwords on the register form) or the
+            # admin has explicitly requested to send an email on the
+            # 'add new user' form.
+            try:
+                # When all goes well, this call actually returns the
+                # rendered mail_password_response template.  As a side
+                # effect, this removes any status messages added to
+                # the request so far, as they are already shown in
+                # this template.
+                response = registration.registeredNotify(user_id)
+                return response
+            except ConflictError:
+                # Let Zope handle this exception.
+                raise
+            except Exception as err:
+                logging.exception(err)
+                ctrlOverview = getMultiAdapter(
+                    (portal, self.request), name="overview-controlpanel"
+                )
+                mail_settings_correct = not ctrlOverview.mailhost_warning()
+                if mail_settings_correct:
+                    # The email settings are correct, so the most
+                    # likely cause of an error is a wrong email
+                    # address.  We remove the account:
+                    # Remove the account:
+                    self.context.acl_users.userFolderDelUsers(
+                        [user_id], REQUEST=self.request
+                    )
+                    self._finishedRegister = False
+                    IStatusMessage(self.request).addStatusMessage(
+                        _(
+                            "status_fatal_password_mail",
+                            default="Failed to create your account: we were "
+                            "unable to send instructions for setting a password "
+                            "to your email address: ${address}",
+                            mapping={"address": data.get("email", "")},
+                        ),
+                        type="error",
+                    )
+                else:
+                    # This should only happen when an admin registers
+                    # a user.  The admin should have seen a warning
+                    # already, but we warn again for clarity.
+                    IStatusMessage(self.request).addStatusMessage(
+                        _(
+                            "status_nonfatal_password_mail",
+                            default="This account has been created, but we "
+                            "were unable to send instructions for setting a "
+                            "password to this email address: ${address}",
+                            mapping={"address": data.get("email", "")},
+                        ),
+                        type="warning",
+                    )
+
+    def applyProperties(self, userid, data):
+        portal = getToolByName(self.context, "portal_url").getPortalObject()
+        mt = getToolByName(self.context, "portal_membership")
+        member = mt.getMemberById(userid)
+
+        # cache adapters
+        adapters = {}
+
+        # Set any fields that are simply properties for the new user, rather
+        # than fields to help create the new user
+        register_fields = getFieldNames(IRegisterSchema) + getFieldNames(IAddUserSchema)
+        for k, value in data.items():
+            # skip fields not available in the schema
+            if k in ["login_name", "user_id"]:
+                continue
+
+            # skip fields that are handled exclusively on user registration and
+            # are not part of personal information form
+            if k in register_fields:
+                continue
+
+            # get schema adapter
+            schema = self.fields[k].field.interface
+            if schema in adapters:
+                adapter = adapters[schema]
+            else:
+                adapters[schema] = adapter = getAdapter(portal, schema)
+                adapter.context = member
+                adapter.schema = schema
+
+            # finally set value
+            setattr(adapter, k, value)
+
+
+class RegistrationForm(BaseRegistrationForm):
+    """Dynamically get fields from user data, through admin config settings."""
+
+    label = _("heading_registration_form", default="Registration form")
+    description = ""
+    template = ViewPageTemplateFile("register_form.pt")
+
+    @property
+    def showForm(self):
+        """The form should not be displayed to the user if the system is
+        incapable of sending emails and email validation is switched on
+        (users are not allowed to select their own passwords).
+        """
+        portal = getUtility(ISiteRoot)
+        ctrlOverview = getMultiAdapter(
+            (portal, self.request), name="overview-controlpanel"
+        )
+
+        settings = self._get_security_settings()
+        # hide form if mailhost_warning == True and
+        # enable_user_pwd_choice == False
+        return not (
+            ctrlOverview.mailhost_warning() and not settings.enable_user_pwd_choice
+        )
+
+    def updateFields(self):
+        if not self.showForm:
+            # We do not want to spend time calculating fields that
+            # will never get displayed.
+            return
+
+        super().updateFields()
+        defaultFields = field.Fields(self.fields)
+
+        # Can the user actually set his/her own password?
+        settings = self._get_security_settings()
+        if not settings.enable_user_pwd_choice:
+            # No? Remove the password fields.
+            defaultFields = defaultFields.omit("password", "password_ctl")
+        else:
+            # The portal is not interested in validating emails, and
+            # the user is not interested in getting an email with a
+            # link to set his password if he can set this password in
+            # the current form already.
+            defaultFields = defaultFields.omit("mail_me")
+
+        self.fields = defaultFields
+
+    def updateWidgets(self):
+        if not self.showForm:
+            # We do not want to spend time calculating widgets that
+            # will never get displayed.
+            return
+
+        super().updateWidgets()
+        settings = self._get_security_settings()
+        if not settings.enable_user_pwd_choice:
+            # Show a message indicating that a password reset link
+            # will be mailed to the user.
+            widget = self.widgets["mail_me"]
+            widget.mode = DISPLAY_MODE
+            widget.value = ["selected"]
+            widget.label = _(
+                "label_password_change_mail",
+                default="A URL will be generated and e-mailed to you; "
+                "follow the link to reach a page where you can "
+                "change your password and complete the registration "
+                "process.",
+            )
+            widget.terms = None
+            widget.updateTerms()
+
+
+class RegisteredView(BrowserView):
+    def expire_date(self):
+        ppr = getToolByName(self.context, "portal_password_reset")
+        expire_length = datetime.timedelta(days=ppr.getExpirationTimeout())
+        expiration_date = datetime.datetime.now() + expire_length
+        ploneview = getMultiAdapter((self.context, self.request), name="plone")
+        return ploneview.toLocalizedTime(expiration_date, long_format=1)
+
+
+class AddUserForm(BaseRegistrationForm):
+    label = _("heading_add_user_form", default="Add New User")
+    description = ""
+    template = ViewPageTemplateFile("newuser_form.pt")
+
+    def updateFields(self):
+        super().updateFields()
+        defaultFields = field.Fields(self.fields)
+
+        # The mail_me field needs special handling depending on the
+        # enable_user_pwd_choice setting and on the correctness of the mail
+        # settings.
+        portal = getUtility(ISiteRoot)
+        ctrlOverview = getMultiAdapter(
+            (portal, self.request), name="overview-controlpanel"
+        )
+        mail_settings_correct = not ctrlOverview.mailhost_warning()
+        if mail_settings_correct:
+            # Make the password fields optional: either specify a
+            # password or mail the user (or both).  The validation
+            # will check that at least one of the options is chosen.
+            defaultFields["password"].field.required = False
+            defaultFields["password_ctl"].field.required = False
+            settings = self._get_security_settings()
+            defaultFields["mail_me"].field.default = not settings.enable_user_pwd_choice
+
+        # Append the manager-focused fields
+        registry = getUtility(IRegistry)
+        user_group_settings = registry.forInterface(
+            IUserGroupsSettingsSchema, prefix="plone"
+        )
+        many_groups = user_group_settings.many_groups
+        if not many_groups:
+            allFields = defaultFields + field.Fields(IAddUserSchema)
+            allFields["groups"].widgetFactory = CheckBoxFieldWidget
+        else:
+            allFields = defaultFields
+        self.fields = allFields
+
+    def updateWidgets(self):
+        super().updateWidgets()
+
+        # set display mode for mail_me field if no mailhost is configured
+        portal = getUtility(ISiteRoot)
+        ctrlOverview = getMultiAdapter(
+            (portal, self.request), name="overview-controlpanel"
+        )
+        mail_settings_correct = not ctrlOverview.mailhost_warning()
+        if not mail_settings_correct:
+            widget = self.widgets["mail_me"]
+            widget.mode = DISPLAY_MODE
+            widget.value = ["selected"]
+            widget.label = _(
+                "label_cant_mail_password_reset",
+                default="Normally we would offer to send the user an email "
+                "with instructions to set a password on completion "
+                "of this form. But this site does not have a valid "
+                "email setup. You can fix this in the Mail settings.",
+            )
+            widget.terms = None
+            widget.updateTerms()
+
+    @button.buttonAndHandler(_("label_register", default="Register"), name="register")
+    def action_join(self, action):
+        data, errors = self.extractData()
+
+        # extra password validation
+        self.validate_registration(action, data)
+
+        if action.form.widgets.errors:
+            self.status = self.formErrorsMessage
+            return
+
+        self.handle_join_success(data)
+
+        if not self._finishedRegister:
+            return
+
+        portal_groups = getToolByName(self.context, "portal_groups")
+        user_id = data["user_id"]
+        is_zope_manager = getSecurityManager().checkPermission(
+            ManagePortal,
+            self.context,
+        )
+        try:
+            # Add user to the selected group(s)
+            if data.get("groups", None) is not None:
+                for groupname in data["groups"]:
+                    group = portal_groups.getGroupById(groupname)
+                    if "Manager" in group.getRoles() and not is_zope_manager:
+                        raise Forbidden
+                    portal_groups.addPrincipalToGroup(user_id, groupname, self.request)
+        except (AttributeError, ValueError) as err:
+            IStatusMessage(self.request).addStatusMessage(err, type="error")
+            return
+
+        IStatusMessage(self.request).addStatusMessage(_("User added."), type="info")
+        self.request.response.redirect(
+            self.context.absolute_url()
+            + "/@@usergroup-userprefs?searchstring="
+            + user_id
+        )
diff --git a/src/plone/app/layout/users/register_form.pt b/src/plone/app/layout/users/register_form.pt
new file mode 100644
index 00000000..384761c4
--- /dev/null
+++ b/src/plone/app/layout/users/register_form.pt
@@ -0,0 +1,61 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+      xmlns:i18n="http://xml.zope.org/namespaces/i18n"
+      xmlns:metal="http://xml.zope.org/namespaces/metal"
+      xmlns:tal="http://xml.zope.org/namespaces/tal"
+      metal:use-macro="context/main_template/macros/master"
+      i18n:domain="plone"
+>
+
+  <body>
+    <metal:main fill-slot="main">
+      <metal:main-macro define-macro="main">
+
+        <article class="login-wrapper"
+                 id="content"
+        >
+
+          <div class="card">
+            <div class="card-body">
+
+              <tal:mailhost tal:condition="view/showForm">
+                <h1 class="card-title h5"
+                    tal:content="view/label | nothing"
+                ></h1>
+                <metal:block use-macro="context/@@ploneform-macros/titlelessform">
+                  <metal:bottom fill-slot="formbottom">
+                    <input name="came_from"
+                           type="hidden"
+                           tal:define="
+                             came_from request/form/came_from|nothing;
+                           "
+                           tal:condition="came_from"
+                           tal:attributes="
+                             value came_from;
+                           "
+                    />
+                  </metal:bottom>
+                </metal:block>
+              </tal:mailhost>
+
+              <tal:nomailhost tal:condition="not:view/showForm">
+                <h1 class="card-title h5"
+                    tal:content="view/label"
+                    i18n:translate=""
+                ></h1>
+                <div class="documentDescription"
+                     i18n:translate=""
+                >
+                This site doesn't have a valid email setup, so you
+                cannot register at this time.
+                </div>
+              </tal:nomailhost>
+
+            </div>
+          </div>
+
+        </article>
+
+      </metal:main-macro>
+    </metal:main>
+  </body>
+</html>
diff --git a/src/plone/app/layout/users/registered.pt b/src/plone/app/layout/users/registered.pt
new file mode 100644
index 00000000..f2b63f7c
--- /dev/null
+++ b/src/plone/app/layout/users/registered.pt
@@ -0,0 +1,157 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+      xmlns:i18n="http://xml.zope.org/namespaces/i18n"
+      xmlns:metal="http://xml.zope.org/namespaces/metal"
+      xmlns:tal="http://xml.zope.org/namespaces/tal"
+      metal:use-macro="context/main_template/macros/master"
+      xml:lang="en"
+      i18n:domain="plone"
+>
+  <body>
+
+
+    <metal:main fill-slot="main"
+                tal:define="
+                  auth nocall:context/acl_users/credentials_cookie_auth|nothing;
+                "
+    >
+
+      <div id="content-core"
+           tal:condition="python: not auth"
+           i18n:translate="registered_disabled"
+      >
+           Cookie authentication has been disabled.
+      </div>
+
+      <div tal:define="
+             enable_user_pwd_choice python:context.portal_registry['plone.enable_user_pwd_choice'];
+           "
+           tal:condition="python: auth"
+           tal:omit-tag=""
+      >
+
+        <h1 class="documentFirstHeading"
+            i18n:translate="heading_welcome"
+        >
+            Welcome!
+        </h1>
+
+        <div class="documentDescription"
+             i18n:translate="description_you_are_registered"
+        >
+            You have been registered.
+        </div>
+
+        <div id="content-core">
+          <p tal:condition="not: enable_user_pwd_choice"
+             i18n:translate="description_password_reset_or_registered"
+          >
+                You will receive an e-mail shortly containing a URL that will allow you to
+                set your password. When you receive this e-mail, please follow the link to
+                complete your registration process. NOTE: The password reset URL will expire
+                on
+            <span tal:replace="view/expire_date"
+                  i18n:name="time"
+            ></span>. If your
+                password reset request expires, you may use the "Forgot your password" link
+                to generate another password reset request.
+          </p>
+
+          <tal:block condition="enable_user_pwd_choice">
+            <p i18n:translate="description_you_can_log_on_now">
+                    Click the button to log in immediately.
+            </p>
+
+            <div class="portalMessage error pat-cookietrigger"
+                 style="display:none"
+            >
+              <strong i18n:translate="">
+                        Error
+              </strong>
+              <span tal:omit-tag=""
+                    i18n:translate="enable_cookies_message_before_login"
+              >
+                        Cookies are not enabled. You must enable cookies before you can log in.
+              </span>
+            </div>
+
+
+            <form action=""
+                  method="post"
+                  tal:define="
+                    form request/form;
+                    username python: form.get('form.widgets.username') or form.get('form.username');
+                    password python: form.get('form.widgets.password') or form.get('form.password');
+                    ac_name auth/name_cookie|string:__ac_name;
+                    ac_password auth/pw_cookie|string:__ac_password;
+                    portal_url context/portal_url;
+                  "
+                  tal:attributes="
+                    action python:'%s/login_form' % portal_url;
+                  "
+            >
+
+              <input name="form.submitted"
+                     type="hidden"
+                     value="1"
+              />
+              <input id="js_enabled"
+                     name="js_enabled"
+                     type="hidden"
+                     value="0"
+              />
+              <input id="cookies_enabled"
+                     name="cookies_enabled"
+                     type="hidden"
+                     value="0"
+              />
+              <input id="login_name"
+                     name="login_name"
+                     type="hidden"
+                     value=""
+              />
+              <input id="pwd_empty"
+                     name="pwd_empty"
+                     type="hidden"
+                     value="0"
+              />
+
+              <input name="came_from"
+                     type="hidden"
+                     value=""
+                     tal:attributes="
+                       value request/came_from|nothing;
+                     "
+              />
+              <input name="ac_name"
+                     type="hidden"
+                     value=""
+                     tal:attributes="
+                       id ac_name;
+                       name ac_name;
+                       value username;
+                     "
+              />
+              <input name="ac_password"
+                     type="hidden"
+                     value=""
+                     tal:attributes="
+                       name ac_password;
+                       id ac_password;
+                       value password;
+                     "
+              />
+              <input class="btn btn-secondary"
+                     name="buttons.login"
+                     type="submit"
+                     value="Log in"
+                     i18n:attributes="value label_log_in;"
+              />
+            </form>
+          </tal:block>
+        </div>
+
+      </div>
+
+    </metal:main>
+  </body>
+</html>
diff --git a/src/plone/app/layout/users/schema_layout.pt b/src/plone/app/layout/users/schema_layout.pt
new file mode 100644
index 00000000..9c233efe
--- /dev/null
+++ b/src/plone/app/layout/users/schema_layout.pt
@@ -0,0 +1,69 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+      xmlns:i18n="http://xml.zope.org/namespaces/i18n"
+      xmlns:metal="http://xml.zope.org/namespaces/metal"
+      xmlns:tal="http://xml.zope.org/namespaces/tal"
+      lang="en"
+      metal:use-macro="here/prefs_main_template/macros/master"
+      xml:lang="en"
+      i18n:domain="plone"
+>
+
+  <body>
+
+    <div metal:fill-slot="prefs_configlet_main">
+
+      <a class="link-parent"
+         id="setup-link"
+         tal:attributes="
+           href string:$portal_url/@@overview-controlpanel;
+         "
+         i18n:translate=""
+      >
+      Site Setup
+      </a>
+
+      <h1 class="documentFirstHeading"
+          i18n:translate=""
+      >Edit Member Form Fields</h1>
+
+      <div metal:use-macro="context/global_statusmessage/macros/portal_message">
+    Portal status message
+      </div>
+
+      <div id="content-core">
+
+        <ul class="nav nav-tabs">
+          <li class="nav-item">
+            <a class="nav-link"
+               href="${portal_url}/@@usergroup-userprefs"
+               i18n:translate="label_users"
+            >Users</a>
+          </li>
+          <li class="nav-item">
+            <a class="nav-link"
+               href="${portal_url}/@@usergroup-groupprefs"
+               i18n:translate="label_groups"
+            >Groups</a>
+          </li>
+          <li class="nav-item">
+            <a class="nav-link"
+               href="${portal_url}/@@usergroup-controlpanel"
+               i18n:translate="label_usergroup_settings"
+            >Settings</a>
+          </li>
+          <li class="nav-item">
+            <a class="nav-link active"
+               href="${portal_url}/@@member-fields"
+               i18n:translate="label_member_fields"
+            >Member fields</a>
+          </li>
+        </ul>
+
+        <tal:block tal:replace="structure view/contents|view/render" />
+
+      </div>
+
+    </div>
+
+  </body>
+</html>
diff --git a/src/plone/app/layout/users/schemaeditor.py b/src/plone/app/layout/users/schemaeditor.py
new file mode 100644
index 00000000..ecaeba02
--- /dev/null
+++ b/src/plone/app/layout/users/schemaeditor.py
@@ -0,0 +1,35 @@
+from plone.app.users.browser.schemaeditor import ALLOWED_FIELDS
+from plone.app.users.browser.schemaeditor import getFromBaseSchema
+from plone.app.users.schema import IMemberSchemaContext
+from plone.app.users.schema import IUserDataSchema
+from plone.app.users.schema import SCHEMATA_KEY
+from plone.base import PloneMessageFactory as _
+from plone.schemaeditor.browser.schema.listing import SchemaListing
+from plone.schemaeditor.browser.schema.traversal import SchemaContext
+from plone.z3cform.layout import FormWrapper
+from Products.Five.browser.pagetemplatefile import ViewPageTemplateFile
+from zope.interface import implementer
+
+
+class SchemaListingPage(FormWrapper):
+    form = SchemaListing
+    index = ViewPageTemplateFile("schema_layout.pt")
+
+
+@implementer(IMemberSchemaContext)
+class MemberSchemaContext(SchemaContext):
+    label = _("Edit Member Form Fields")
+
+    def __init__(self, context, request):
+        self.fieldsWhichCannotBeDeleted = ["fullname", "email"]
+        self.showSaveDefaults = False
+        self.enableFieldsets = False
+        self.allowedFields = ALLOWED_FIELDS
+
+        schema = getFromBaseSchema(IUserDataSchema)
+        super().__init__(
+            schema,
+            request,
+            name=SCHEMATA_KEY,
+            title=_("Member Fields"),
+        )
diff --git a/src/plone/app/layout/users/userdatapanel.py b/src/plone/app/layout/users/userdatapanel.py
new file mode 100644
index 00000000..29347e39
--- /dev/null
+++ b/src/plone/app/layout/users/userdatapanel.py
@@ -0,0 +1,55 @@
+from plone.app.layout.users.account import AccountPanelForm
+from plone.app.users.browser.userdatapanel import getUserDataSchema
+from plone.base import PloneMessageFactory as _
+from Products.CMFCore.utils import getToolByName
+from Products.Five.browser.pagetemplatefile import ViewPageTemplateFile
+from zExceptions import NotFound
+
+try:
+    from html import escape
+except ImportError:
+    from cgi import escape
+
+
+class UserDataPanel(AccountPanelForm):
+    form_name = _("User Data Form")
+    enableCSRFProtection = True
+
+    @property
+    def schema(self):
+        schema = getUserDataSchema()
+        return schema
+
+    @property
+    def description(self):
+        userid = self.request.form.get("userid")
+        mt = getToolByName(self.context, "portal_membership")
+        if userid and (userid != mt.getAuthenticatedMember().getId()):
+            # editing someone else's profile
+            return _(
+                "description_personal_information_form_otheruser",
+                default="Change personal information for $name",
+                mapping={"name": escape(userid)},
+            )
+        else:
+            # editing my own profile
+            return _(
+                "description_personal_information_form",
+                default="Change your personal information",
+            )
+
+    def __call__(self):
+        userid = self.request.form.get("userid")
+        if userid:
+            mt = getToolByName(self.context, "portal_membership")
+            if mt.getMemberById(userid) is None:
+                raise NotFound("User does not exist.")
+        self.request.set("disable_border", 1)
+        return super().__call__()
+
+
+class UserDataConfiglet(UserDataPanel):
+    """Control panel version of the userdata panel"""
+
+    template = ViewPageTemplateFile("account-configlet.pt")
+    tab = "userdata"
