User Provisioning and License Limits
Provisioning users
A common practice when provisioning users from an external identity provider (IdP) is assigning large groups of users to an application, even if only a small subset of these users will be active. Posit Workbench supports this practice by considering provisioned users inactive until they log in for the first time. Inactive users do not count towards the license user limit.
When a user successfully logs in for the first time, they will be considered active and count towards the license user limit. If the user limit on the license has been reached, users can still be provisioned from the IdP, but they cannot log in until a license seat becomes available.
Existing local users
Existing users transferred from a local authentication system retain their locked status within Workbench. See this guide’s Transferring existing users section for more information.
Locking and unlocking users
Workbench users can be locked by unassigning them from the application in the IdP. Locked users do not count towards the license user limit. By design, when users are unassigned from the IdP application, they are not removed from Workbench but are instead locked.
While our recommendation is to manage users’ locked status in your IdP, this method does not affect an immediate sign-out of the user and they may still be able to access Workbench until their current login session expires. If immediate action is required, the rstudio-server lock-user and rstudio-server unlock-user commands can be used to lock and unlock users in Workbench by passing the --force option:
$ sudo rstudio-server unlock-user <username> --force
$ sudo rstudio-server lock-user <username> --forceReassigning Workbench users to the application in the IdP unlocks their account status.
When reassigning a user considered active, the user remains locked and is unable to log in if the user limit has been reached. If this occurs, please contact Posit Support (support@posit.co) to resolve the issue with your license. Once a license seat becomes available for the user, manually unlock their account via the rstudio-server unlock-user command.
See the License Management section of this guide for more information on licensing in Workbench.