lahirujayathilake opened a new issue, #511: URL: https://github.com/apache/airavata-custos/issues/511
### Problem Custos resolves OIDC sign-ins by looking up the verified subject identifier (`oidc_sub`) in `user_identities`. Any user provisioned through a channel other than OIDC therefore cannot sign in until an administrator manually inserts a binding row by hand. This affects every channel that creates user records: 1. **AMIE allocation packets** - ACCESS-CI delivers PI accounts ahead of the user's first sign-in. The handler creates the `users` row and a `user_identities` row for the AMIE source, but no OIDC binding exists. First sign-in via CILogon returns `401 identity_not_linked` with no self-service path forward. 2. **Bootstrap super_admin** - `CUSTOS_BOOTSTRAP_ADMIN_EMAIL` grants the super_admin role to a user looked up by email, but the bootstrap path doesn't create or link the OIDC identity. The operator has to insert a `user_identities` row before they can sign in to the system they were supposed to administer. 3. **Future system identities** - any new provisioner (COmanage, SLURM, custom upstream) that creates users before they sign in will inherit the same dead-end. Net effect: every "upstream-first" user flow has a hidden manual step between provisioning and actual portal access. The portal works perfectly for the second and subsequent sign-ins, it just can't onboard the first. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
