User Management
The core object for managing people and organisations in Trivore ID is the user account. This section covers user accounts conceptually — their types and lifecycle — and the related concepts of groups, group policies, invites, and strong identification. For day-to-day administrative tasks, see Accounts in the Management section.
Account types
A user account can represent either a real person or a legal entity such as an organisation. Accounts are real persons by default; the account type can be changed at any time, in the Management UI's account editor or via the Management API.
Account lifecycle
User accounts can be created individually via the Management UI or the Management API, in bulk by importing a file, by inviting people to create their own account by email, or by letting users register themselves from the OpenID Connect sign-in view. It's also possible to pre-create data for accounts that don't exist yet, so that information is ready to apply automatically once the account is created.
An account can be locked to temporarily disable sign-in without losing any data, and its owner can request or be forced to change or reset their password at any point.
Deleting a user account isn't necessarily immediate: accounts can be archived — marked for deletion but kept recoverable — and only purged (permanently removed) after a set amount of time has passed. Avoid fully deleting an account until you're sure none of the objects related to it (such as contracts or authorisations) are still needed; legal requirements may also dictate how long some of that data must be retained. See GDPR for how Trivore ID supports personal data removal requests specifically.
Groups, roles, and policies
Individual user accounts are rarely managed one at a time for anything beyond basic CRUD. Groups tie user accounts together with the roles and Group Policies that grant permissions and configure account-level settings (such as MFA requirements or session timeouts) for everyone in the group at once — see Groups and Group Policies for how this works in the Management UI.
Strong identification
Beyond a username and password, Trivore ID can record that a user account has undergone strong identification — a more rigorous, often government-backed or in-person verification of the person's real identity, at a specific Level of Assurance (LoA). See Strong Identification for the methods supported and how to query or initiate identification via the API.