ContextQMD
Back to Mattermost

Provisioning workflows

docs/main/administration-guide/onboard/user-provisioning-workflows.mdx

11.10.03.8 KB
Original Source
<PlanAvailability slug="all-commercial" />

This document provides an overview of user provisioning and deprovisioning workflows in Mattermost.

There are currently 3 recommended user provisioning workflows in Mattermost:

  1. On demand: If user accounts are not pre-provisioned using one of the methods described below, then a new user account will be provisioned when the user first logs in. When the user logs in, they are asked to select a public team to join (all users must belong to at least one team) and then they are added automatically to the Town Square channel. Mattermost also has a default channel setting that enables system admins to add everyone to additional channels specified by the organization.
  2. Pre-provisioned via bulk import: Mattermost features a bulk data loading tool that can be used for pre-provisioning new users by adding them to teams and channels before their first login to Mattermost. This tool automates the creation of Teams, Channels, Users, and Posts (with file attachments). It can also be used to migrate users and content from an existing system.
  3. Mattermost API: The Mattermost RESTful API can be used to pre-provision new user accounts as well as add and remove them from teams and channels. This model is commonly used by enterprises that have central account provisioning applications.

Mattermost user identifier

The user identifier used to uniquely identify users in Mattermost depends on the method of authentication:

  • Email/password: Email address or username. Created by the user or previously described account pre-provisioning process.
  • AD/LDAP: Configure a unique and unchanging ID Attribute from the AD/LDAP server to be used in Mattermost. If a user's ID Attribute changes, it will create a new Mattermost account unassociated with their old one.
  • SAML 2.0: Selected during configuration. You may use an Id Attribute instead of email to bind the user. We recommend choosing an ID that is unique and will not change over time.

User deprovisioning

Users in Mattermost can be deactivated in the following ways:

  • AD/LDAP Synchronization: AD/LDAP users can be deactivated in Mattermost based on their status in the directory server via synchronization. Learn more in AD/LDAP documentation.
  • System Console: User management screen in System Console > Users allows system admins to deactiveate users with email/password login. See the Deactivate users documentation for details.
  • RESTful API The Mattermost API can be used to deactivate users. See API documentation to learn more.
  • Command Line Interface: You can use the Mattermost mmctl user deactivate command to deactivate users.

Once deactivated, users still exist in the Mattermost database and their messages can still be viewed in Mattermost. You can use the mmctl tools to delete a user and all of their content.

From Mattermost v10.10, when a user is deactivated, the account's availability is automatically set to offline.

<Note>

As long as the ID attribute selected via AD/LDAP or SAML 2.0 is a unique identifier, the user’s email address or name (along with other attributes) can be updated without breaking the user’s account.

</Note>