User provisioning

You can create local users through Access Management > Users tab in the UI. You must have a role with the user:create permission to create users. The built-in admin role includes this permission by default.

Automation orchestrator provisions identity provider users automatically on first login through just-in-time provisioning. It creates a user record from the ID token claims:

• Username maps to the username claim mapping (default: preferred_username), or the local part of the email address. If the derived username already exists, automation orchestrator appends a random suffix.
• Email maps to the email claim mapping (default: email). Email is unique but not mandatory.
• First name maps to the first name claim mapping (default: given_name).
• Last name maps to the last name claim mapping (default: family_name).

If the ID token is missing key claims, automation orchestrator fetches supplementary claims from the identity provider's userinfo endpoint.

If a user signs in with an email that belongs to a different account, automation orchestrator blocks the login. This occurs when no identity provider link exists between the accounts.

On subsequent logins, user attributes and group memberships are synchronized from the identity provider.

Automation orchestrator does not automatically deprovision users when you remove them from the identity provider. To remove access, delete the user manually from automation orchestrator.