Support adding users to orgs without an invite.

[ikreymer]

In certain cases, it may be useful to add users directly to an archive w/o going through the invite flow.
The admin user would have the option to add a user, setting the e-mail, name and password directly.
(Possibly also an option to allow users to create their own archives?)

[ikreymer]

Thinking if this should be a deployment setting, eg. to allow adding by e-mail for an institutional deployment, but not necessarily a public one?
The invite api could even do this automatically, eg. if user exists, and direct adding to archive is allowed, it will just add the user, otherwise send the invite, and then just need to show a different message?

[ikreymer]

I guess there's two aspects to this:

• Adding an already registered users to an archive (the above is about that, where this could be detected an automated)
• Adding a new user to an archive, and potentially automatically registering them and setting a password for them

[ikreymer]

Another idea discussed is 'bulk invites', where the admin can enter a list of users to add to the archive, and will send emails to each one after they've been added.

Need to gather more info on specific use cases.

[ato]

For the case of institutional deployment I would imagine many institutions have an existing corporate single sign on service they'd ideally authenticate against.

In our case we use OAuth2/OpenID Connect against Keycloak for single sign on for most of our applications but if that's not an option we will sometimes use SAML, LDAP, PAM or pass username and email via HTTP request headers (e.g. using oauth2-proxy).

[anjackson]

Our position is similar to @ato's - rather than manually adding users, we'd rather the system could be configured to pick up the username from a HTTP request header (sometimes referred to as REMOTE-USER authentication). BC should then auto-create accounts as needed, trusting the upstream proxy to handle authentication. This is how UKWA currently manages authentication (via an NGINX proxy and the auth_request module).

There are many tools that support this pattern, like oauth2proxy (mentioned by @ato) or vouch-proxy, and I like how this approach separates out the fiddly authentication logic.

[ldko]

After talking with our Library IT people, to run an instance for use by others at our institution, they would want us to be able to set up with LDAP.

[tw4l]

Re: #244 (comment), commit d1b59c9 adds a new {API_PREFIX}/archives/{archive_id}/add-user API endpoint which can be used to create a non-existing user and automatically add them to an existing archive. This is thus far only used internally for testing.