Authentication nodes

Provision Dynamic Account node

Not supported in Advanced Identity Cloud

The Provision Dynamic Account node provisions an account following successful authentication by a SAML2 Authentication node or a Social Provider Handler node.

Accounts are provisioned using properties defined in the attribute mapper configuration of the SAML2 Authentication node or Social Provider Handler node earlier in the flow.

Example

In this example, the node lets users who have performed social authentication using Google provide a password and provision an account if they don’t have a matching existing profile. They must enter a one-time passcode to verify they are the owner of the Google account.

Dynamic account provisioning in context

Availability

Product Available?

PingOne Advanced Identity Cloud

No

PingAM (self-managed)

Yes

Ping Advanced Identity Software (self-managed)

No

Inputs

The node first attempts to retrieve user attributes from objectAttributes in node state. If objectAttributes contains attributes, the node uses them to provision the account. If it’s empty, the node requires the userInfo shared state object, which must contain userNames and the mapped attributes used to provision the account.

The node optionally uses the password state property. If it’s not present, the node generates a random password.

Dependencies

A preceding node must populate either objectAttributes or userInfo with the user’s mapped attributes.

Typically, objectAttributes is populated by the Social Provider Handler node, and userInfo is populated by the SAML2 Authentication node. However, other nodes or scripts might populate these state objects.

Use either the SAML2 Authentication node or the Social Provider Handler node earlier in the journey, as required.

Configuration

Property Usage

Account Provider

The name of the class that implements the account provider.

Default: org.forgerock.openam.authentication.modules.common.mapping.DefaultAccountProvider

Outputs

The node creates a user account with the mapped attributes and sets the username shared state property to the provisioned user’s username.

Callbacks

This node doesn’t send any callbacks.

Outcomes

Single outcome path.

Errors

The node can log the following errors:

  • No user information has been found in the shared state.

    A preceding node didn’t set the userInfo shared state property.

  • The user information doesn’t contain the userNames. You must call a node that sets this information first

    The userInfo shared state object doesn’t contain userNames.

  • Unable to create user

    The account provider couldn’t create the user account.