Hi, I have the following relation: A user can be a...
# talk-kratos
b
Hi, I have the following relation: A user can be a part of an organization. Now when a user signs up, it creates an organization for that particular user and assigns the user as the owner of that organization. What would be a good way to invite users to an organization? How would I be able to use an invite code with the kratos registration flow for example? Or would I have to build my own form and create the user on the backend?
s
For Ory Cloud we build a custom back-end handling invites, and it turned out to be quite complex 😅 User management is done through Kratos and authorization through Keto
It all basically depends on the `return_url`s holding the invite code
b
@steep-lamp-91158 Maybe a better approach would be to generate an account automatically when a user is invited, email the user a generated password and prompt them to change it when they first log in
s
It will be a bit more complex than that. For creating accounts on behalf of a user, you should really do https://www.ory.sh/docs/guides/manage-identities/create-users-identities which creates an account without credentials. You can then trigger the recovery flow through the admin API and send it to the user via email https://www.ory.sh/docs/kratos/reference/api#operation/adminCreateSelfServiceRecoveryLink
But what happens if the user is already registered? What happens if the user wants to register with a different email?
b
@steep-lamp-91158 I guess you can send the user an email that someone tried to invite them to an organization. And for the signing up with a different email part, I don't see any scenario where that would be applicable, an employer would ask the employee for an email address to deliver the invite to
s
They could change the email after signing in though. But I guess they could always
b
Yeah they could change their email through the settings flow
@steep-lamp-91158 Can you share some more info about the "return url holding the invite code"?
I assume the flow goes like this
s
yes, basically that
you could skip the first part and already use the
/auth/login?return_to=...
url in the mail
or use the first endpoint to decide where to go, i.e. whether the user already exists