Currently my company has 2 applications that use Identity Server for SSO. Not every client we have uses both applications but some do. The part I'm uneasy about is that both apps have a user management section that adds users to IS by calling an api in IS. They even get a different token to do this behind the scenes (using client_credentials).

This seems like a horribly bad practice, not only because there is coupling between IS and both apps, but having our clients create users in SSO.

I feel like it's fine for clients to add users (inside the respective app) but they creation of the account in SSO should be the user themself.

I'm just wondering what best practices are out there for managing users across different apps, sign up flows, assigning roles, etc. are.

  • All of these issues depend upon the needs of your organisation and their preferred policy around user account creation and identity/access management. Questions such as "who owns the process of creating a user?" or "Who is responsible for managing users?" needs to be directed at whoever owns the system - some organisations may have legitimate concerns about allowing users to create their own accounts. Commented May 12, 2023 at 8:25


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.