---
title: Provision Dynamic Account node
description: Use the Provision Dynamic Account node in PingAM to create a user account after SAML2 or social authentication using attributes from the identity provider.
component: auth-node-ref
version: 8.1
page_id: auth-node-ref:am-only:provision-dynamic-account
canonical_url: https://docs.pingidentity.com/auth-node-ref/latest/am-only/provision-dynamic-account.html
llms_txt: https://docs.pingidentity.com/auth-node-ref/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: 2026-09-01T13:00:59Z
page_aliases: ["auth-node-provision-dynamic-account.adoc"]
section_ids:
  example: Example
  availability: Availability
  inputs: Inputs
  dependencies: Dependencies
  configuration: Configuration
  outputs: Outputs
  callbacks: Callbacks
  outcomes: Outcomes
  errors: Errors
---

# Provision Dynamic Account node

The Provision Dynamic Account node provisions an account following successful authentication by a [SAML2 Authentication node](../saml2.html) or a [Social Provider Handler node](../social-provider-handler.html).

Accounts are provisioned using properties defined in the attribute mapper configuration of the SAML2 Authentication node or Social Provider Handler node earlier in the flow.

## Example

In this example, the node lets users who have performed social authentication using Google provide a password and provision an account if they don't have a matching existing profile. They must enter a one-time passcode to verify they are the owner of the Google account.

![Dynamic account provisioning in context](_images/trees-node-Google-DynamicAccountCreation-example.png)

## Availability

| Product                               | Available? |
| ------------------------------------- | ---------- |
| PingOne Advanced Identity Cloud       | No         |
| PingAM (self-managed)                 | Yes        |
| Ping Identity Platform (self-managed) | No         |

## Inputs

The node first attempts to retrieve user attributes from `objectAttributes` in node state. If `objectAttributes` contains attributes, the node uses them to provision the account. If it's empty, the node requires the `userInfo` shared state object, which must contain `userNames` and the mapped `attributes` used to provision the account.

The node optionally uses the `password` state property. If it's not present, the node generates a random password.

## Dependencies

A preceding node must populate either `objectAttributes` or `userInfo` with the user's mapped attributes.

Typically, `objectAttributes` is populated by the Social Provider Handler node, and `userInfo` is populated by the SAML2 Authentication node. However, other nodes or scripts might populate these state objects.

Use either the [SAML2 Authentication node](../saml2.html) or the [Social Provider Handler node](../social-provider-handler.html) earlier in the journey, as required.

## Configuration

| Property         | Usage                                                                                                                                                   |
| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Account Provider | The name of the class that implements the account provider.Default: `org.forgerock.openam.authentication.modules.common.mapping.DefaultAccountProvider` |

## Outputs

The node creates a user account with the mapped attributes and sets the `username` shared state property to the provisioned user's username.

## Callbacks

This node doesn't send any callbacks.

## Outcomes

Single outcome path.

## Errors

The node can log the following errors:

* `No user information has been found in the shared state.`

  A preceding node didn't set the `userInfo` shared state property.

* `The user information doesn't contain the userNames. You must call a node that sets this information first`

  The `userInfo` shared state object doesn't contain `userNames`.

* `Unable to create user`

  The account provider couldn't create the user account.