then all you should have to do is add to the user's variables collection and call savechanges, you don't even need to explicitly set the reference to the user
if you got the object from a query on the same dbcontext (that didn't use AsNoTracking), explicitly added it with Add, or is a member of an object that meets those conditions, it's handled by the change tracker