Add a person

Add somebody to the workspace and, on a deployment with accounts, get them signed in.

Before you start

• You are signed in as an Administrator — only that role can manage people.
• Know which of the four roles they need, and, for a Source System person, which system they answer for: the role selector can change the role later, but not the system attached to it.
• Under DPF_IDENTITY=entra, this page does not apply: people and their roles come from the directory, not from here — see Identity and Turn on Entra ID.

Steps

1. Open Users in the sidebar.
2. Under Add somebody, enter their Name, pick a Role, and leave Any source system unless they answer for one in particular. Select Add.

On the open door (no accounts — DPF_IDENTITY unset or open), that is the whole job: "name added.", email optional, and anybody can act as them from the sidebar.

On a door with accounts (site, link or site+link):

3. An email is required — it is what they sign in with.
4. The page shows a one-time sign-in link once, in the confirmation banner: valid for 7 days, usable once. Send it to them yourself — the application has no mail server of its own.
5. They open it, set a password of at least 12 characters twice, and are signed in. If the link expires, or they need a new password, open their row on the Users page and select Sign-in link (New sign-in link, once one exists) — it issues a fresh link and invalidates any password already set.

Check that it worked

They appear on the Users page with password set instead of no sign-in once they have set one, and the role strip's counts at the top of the page include them.

If it does not work

• Every administrator is locked out. Nobody can remove or demote the last Administrator from inside the app, so recovery is from the shell, as the service account with its environment loaded (see Deploy): .venv/bin/python -m dpf user add admin@example.com --name "…" --role admin both creates the person and prints a one-time sign-in link, in one step — there is no need to also run user invite. Use .venv/bin/python -m dpf user invite admin@example.com instead when the person already exists and only needs a fresh link.
• A Source System person is answering for the wrong system, or none. The role selector cannot change the system attached to a person — remove them and add them again with the right one.
• Added with no email, and accounts are now required. An email has to be on the person's row before a sign-in link can be sent; open their row and add one.

Related

• Issue an API token — for a system, not a person.
• Identity — the five doors, and how a role is decided under each.
• Turn on Entra ID — where people are provisioned by the directory instead.