How user accounts link to identity providers

Automation orchestrator links user accounts to identity providers:

• Each user has a local record in automation orchestrator.
• Automation orchestrator tracks external identities as per-provider bindings to the local user record.
• User attributes and group memberships come from the identity provider that authenticated the current session.
• Each user can have identity bindings to multiple identity providers and can log in through any of them.
• A user can have multiple identity bindings to the same identity provider if they have multiple accounts (different OIDC subjects) at that provider. Each binding must have a unique issuer and subject combination. An administrator can attach additional identities using the Identities tab on the user's profile.

Local and identity provider authentication types are mutually exclusive. A local user cannot have an identity provider binding, and an identity provider user cannot set a local password.