Provisioning
Users and profiles are usually created automatically in primedocs, from the corporate directory and from third-party systems. Organizational units, by contrast, are mostly entered by hand in primedocs. This section describes which mechanism supplies which data and how those mechanisms fit together.
The two topics are frequently confused, but they answer different questions:
- Authentication answers "Who is this person?". The directory (Entra ID or Active Directory) handles it through the primedocs Identity Server. primedocs does not manage passwords of its own.
- Provisioning answers "What data does this person have in primedocs?" (user fields, profile, organizational unit, permissions).
The link between them is the PrimarySid: the sign-in supplies it, and primedocs uses it to find the matching user record. For how sign-in works and which authentication methods exist, see Authentication.
Overview
A user is created by signing in, and their fields are filled by user synchronization. The organizational structure is maintained directly in primedocs in most installations. Organization synchronization is an optional addition for cases where a third-party system owns the structure. The profile joins user and organization data and supplies it to document generation.
Which mechanism for what
| Goal | Mechanism |
|---|---|
| Let users work without any preparation | Automatic creation on first sign-in (the default behaviour, nothing to configure). See Onboarding & Offboarding |
| Fill user fields (display name, job title, phone, …) from the directory | User synchronization with one or more sync sources |
| Take user data from a system outside the directory | User synchronization with SQL, CSV, Http or Static |
| Control which users are visible in primedocs at all, for example because no Entra ID application permission may be granted | SCIM provisioning |
| Create technical accounts with no associated person | Manual creation through the Admin API. An account created without a directory account is excluded from user synchronization |
| Build and maintain the organizational structure | Directly in primedocs (the normal case). See Organizational units |
| Take over an organizational structure owned by a third-party system | Optional: organization synchronization using an XML file and the JobHost |
| Grant permissions | Groups and Roles |
| Remove users who have left | Offboarding through user synchronization |
What happens on first sign-in
When a person signs in for the first time, primedocs performs the following steps without any administrator involvement:
- The sign-in identifies the person and supplies their PrimarySid.
- primedocs reads the display name and the group memberships from the directory, because they are not in the sign-in token.
- primedocs looks up the user by PrimarySid. If no user is found, one is created.
- If user synchronization is set up, it fills the user fields immediately on creation.
- Dynamic groups are evaluated.
- The default profile is created and, where this can be determined unambiguously, assigned to an organizational unit.
The full sequence including prerequisites and edge cases is described in Onboarding & Offboarding.
Step 6 only succeeds if one organizational unit follows unambiguously from the permissions. Where several units on the same branch are permitted, the lowest one wins. Where the permitted units are spread across different branches, or none is permitted, the profile is created without an organization assignment and has to be assigned afterwards.
Recommended order for a new installation
For a new rollout, this order has proven itself:
- Set up authentication: connect Entra ID or Active Directory so that users can sign in at all. See Authentication.
- Create the organizational units: usually directly in primedocs, including their permissions. Without a permitted organizational unit, a new user does not get a complete default profile. Where a third-party system owns the structure, organization synchronization is an option instead.
- Configure user synchronization: define the user fields and map the sync sources onto them.
- Let the users sign in: the user records are created automatically in the process.
In this section
- User Synchronization: fill user fields from LDAP/AD, Microsoft Graph, SQL, CSV, HTTP, SCIM or static values.
- Organization Synchronization: optional reconciliation with a third-party system that owns the organizational structure.
- Onboarding & Offboarding: what happens when users join and leave.
- SCIM: provide users and groups through the SCIM standard.