A user is the identity record in an environment. Every environment has its own user store, so the same person signing in to two of your environments is two users.
Below is how those records get created, how identities link together, and how access control applies.
How users are created
Authdog creates or updates the user on the first successful sign-in, whichever method they used:
- Self-service sign-up: password or passwordless / magic link.
- Social OAuth2: Google, GitHub, Microsoft, Apple, and dozens more.
- Enterprise SSO: SAML 2.0 or OIDC, with the user created just-in-time (JIT) on first login.
- Provisioning: created ahead of time via SCIM 2.0 or the HRIS connector, before the user ever signs in.
Identity linking
A person can sign in more than one way. Authdog links those methods to a single user by verified email. If someone signs up with a password and later signs in with a Google account that owns the same verified email, both identities resolve to the same user. An unverified address can't claim an existing account.
Profile and metadata
Each user has a profile (email, name, and attributes from the provider) plus metadata you attach yourself. Use metadata for fields that belong to your app (a plan tier, a preferred locale, an internal ID). Those fields travel with the user, and they're available when you resolve a session. Profile fields that come from SSO or HRIS refresh on later sign-ins and on provisioning syncs.
Lifecycle state
A user is either active or suspended. Suspending someone blocks new sign-ins right away, and they can't establish a session. The record and its history stay, which is what you want for offboarding or a compromised account. When an identity provider deactivates a user through provisioning, Authdog suspends them the same way.
Users and roles
End users live in an environment's user store. That's separate from organization membership, which is for the people who administer the Authdog account and its tenants. What an end user can do comes from the environment's authorization model. See Roles and permissions. Group-to-role mappings from an identity provider or HRIS can grant those roles at provisioning time.
Managing users
Manage users in the console: search, inspect a profile, suspend or reactivate, and review sign-in activity. The same actions are on the REST API under /v1/..., so a backend can list, create, update, and suspend users too.
