Define import policy for SSO/LDAP Gateway users (managed: true)

[jeffmcutter]

Summary

On Gateway, user managed: true means the account is managed by an external authenticator (SAML, OIDC, Keycloak, etc.), not that it is a platform service account. aap-bridge currently exports/imports these users like local users: create by username with a temporary local password. Authenticator linkage is not preserved because authenticators are not migrated.

Current behavior

• No special handling for managed: true users.
• Import creates a local user shell (username, flags, team memberships, RBAC) with a temp password.
• authenticators / maps / plugins are Gateway platform endpoints and are not in the migrate set.
• Support matrix only notes that user passwords are not migrated.

Open questions

1. Should SSO/LDAP users be skipped by default (rely on target JIT / first IdP login)?
2. Or should we keep creating username shells so team memberships and RBAC survive, accepting broken IdP linkage until authenticators exist?
3. Should this be configurable (e.g. skip Gateway managed: true users)?

Proposed direction

• Add an explicit policy (default TBD) and config knob for skipping external/IdP-managed users.
• Document expected target setup: configure authenticators first; users re-bind on login vs pre-create shells for RBAC continuity.
• Do not confuse this with Exclude platform/service users from user export/import #146 (platform/service accounts). Those need username rules (_ prefix + known names); managed is the wrong signal for service accounts.

Related

• Exclude platform/service users from user export/import #146 Exclude platform/service users from user export/import
• Follow-up: unique temporary passwords per migrated user
• Follow-up: authenticator migration / explicit non-support

[jeffmcutter]

Related:

• Exclude platform/service users from user export/import #146 Platform/service user filtering (bug) — different signal (_ / known names, not managed)
• Use a unique temporary password per migrated user #147 Unique temporary passwords
• Spike: migrate Gateway authenticators or document explicit non-support #149 Authenticator migration spike — needed for full SSO fidelity