SSO operator creation and activation
Create missing single sign-on operator accounts from a website template and notify the contact responsible for activation.
What it is
New Operator Template supplies the starting settings for accounts created during single sign-on. When a provider returns an email address that INSIDE has not seen before, INSIDE can create an inactive operator account from this template.
An activation message tells the operator that further action is needed. INSIDE can also email a nominated contact about the new account.
Who uses it and why
Administrators arrange how new SSO users receive initial access and who reviews their accounts. Operators use the activation guidance shown after their first provider sign-in. Powerfront configures automatic creation and its template for the website.
Where to find it
Powerfront manages New Operator Template, Disable Creating User, Operator Notification Email and New Operator Message under Settings › Account › Single Sign-On.
Powerfront also manages Settings › Account › Operator Templates. Users with the Settings or Manager role and the required operator permissions review operator accounts under Settings › Account › Operators.
How it works
- The SAML or OAuth provider returns an authenticated identity with an email address.
- INSIDE looks for an existing operator with that email address. If one exists, it uses that account rather than creating another.
- For an unknown email address, Disable Creating User determines whether creation is allowed.
- Creation requires a valid New Operator Template for the website and an email address that passes the website's permitted-domain checks.
- INSIDE creates the operator with SSO enabled and initial roles and settings from the template. It also copies website-specific defaults, such as channel and skill assignments, and available language, time zone and email signature preferences.
- The new operator receives activation guidance. If Operator Notification Email is set, INSIDE emails that contact to request activation.
The operator must wait for account activation before completing sign-in. Successful authentication at the provider does not activate the local account.
Configure it
Ask Powerfront to choose a suitable operator template and review its starting roles and access. Automatic creation is allowed by default, but cannot succeed without a valid template.
To restrict sign-in to accounts created in advance, ask Powerfront to turn on Disable Creating User.
Give Powerfront the notification address and the guidance you want in New Operator Message. If no custom message is supplied, INSIDE uses its standard activation message.
Arrange an account-review and activation process with the people responsible for operator administration. Review the new account's roles and website access before enabling access.
Settings
| Setting | Where | Applies to | Default | Who can change it | What it does |
|---|---|---|---|---|---|
| Disable Creating User | Settings › Account › Single Sign-On | website | Off | Powerfront | When on, reject unknown SSO identities instead of creating operator accounts; when off, allow creation using a valid template. |
| New Operator Template | Settings › Account › Single Sign-On | website | Not set | Powerfront | Select the website operator template used when SSO encounters an email address without an existing account. Not set prevents automatic account creation. |
| Operator Notification Email | Settings › Account › Single Sign-On | website | Not set | Powerfront | Send a notification to this address when automatic creation produces an operator account needing activation. Not set means no activation notification email is sent. |
| New Operator Message | Settings › Account › Single Sign-On | website | Not set | Powerfront | Replace the standard message shown after automatic account creation with your own activation guidance. When not set, show: Your account needs to be activated, please contact your manager or administrator for further information. |
Permissions
| Permission | Lets you |
|---|---|
| Settings | Manage permitted operator accounts, subject to Settings Permissions. |
| Operators | Allow operator administration within Settings Permissions. |
| Manager | Manage permitted operator accounts, subject to Manager Permissions. |
Limits and good to know
- Existing email matches use the existing account. Automatic creation does not rebuild its permissions from the template.
- A missing or invalid template prevents creation.
- A configured email-domain policy can reject a new identity even after provider authentication succeeds.
- Template changes supply defaults for future creations; they do not synchronise existing operators.
- Automatic creation is a first-sign-in process. Do not rely on it to synchronise a directory or remove INSIDE access when a provider account changes.
Depends on and works with
View all connections as a list
This feature uses
- Operator accountsConfigured by
Newly created SSO accounts must be activated through operator administration before sign-in.
- Operator templatesRequires
Automatic creation requires a valid operator template for the website.
- Single sign-on with SAML 2.0Configured by
For SAML, website Single Sign-On settings select the creation template, notification and activation message.
- Single sign-on with OAuth 2.0Configured by
For OAuth, website Single Sign-On settings select the creation template, notification and activation message.
- Operator sign-in network and email restrictionsConfigured by
New-operator email-domain validation can block account creation.
Used by
- Single sign-on with SAML 2.0Enhances
A provider identity can create a missing operator when automatic creation is configured.
- Single sign-on with OAuth 2.0Enhances
Automatic creation can create a missing provider identity as an INSIDE operator.
FAQ and troubleshooting
Why does a new operator see an activation message?
INSIDE has created an inactive account. Ask the account manager responsible for activation to review it.
Why does an unknown user fail instead of getting an account?
Disable Creating User may be on, the template may be missing or the email domain may be disallowed. Ask Powerfront to check the website's creation settings.
Why was no activation notification sent?
The notification address may not be configured. Ask Powerfront to check Operator Notification Email and email delivery.
Why did changing the template not update an existing operator?
The template supplies initial values for new accounts. Edit existing operator accounts separately.
Can we customise the instructions shown to new operators?
Yes. Ask Powerfront to set New Operator Message to your organisation's activation guidance.