From 3ed126cd961cf877c49ed4c4be79e983daaa7c76 Mon Sep 17 00:00:00 2001 From: tiffany-kobiton Date: Tue, 30 Jun 2026 13:16:42 -0400 Subject: [PATCH 1/6] KOB-51988: draft add-a-non-sso-user-to-an-sso-only-org Co-Authored-By: Claude Opus 4.7 (1M context) --- docs/modules/organization/nav.adoc | 1 + ...add-a-non-sso-user-to-an-sso-only-org.adoc | 167 ++++++++++++++++++ 2 files changed, 168 insertions(+) create mode 100644 docs/modules/organization/pages/sso-authentication/add-a-non-sso-user-to-an-sso-only-org.adoc diff --git a/docs/modules/organization/nav.adoc b/docs/modules/organization/nav.adoc index cf3cab41c..7a65820af 100644 --- a/docs/modules/organization/nav.adoc +++ b/docs/modules/organization/nav.adoc @@ -38,6 +38,7 @@ ** xref:organization:sso-authentication/use-okta.adoc[] ** xref:organization:sso-authentication/use-onelogin.adoc[] ** xref:organization:sso-authentication/use-ping.adoc[] +** xref:organization:sso-authentication/add-a-non-sso-user-to-an-sso-only-org.adoc[] * xref:organization:other-settings.adoc[] diff --git a/docs/modules/organization/pages/sso-authentication/add-a-non-sso-user-to-an-sso-only-org.adoc b/docs/modules/organization/pages/sso-authentication/add-a-non-sso-user-to-an-sso-only-org.adoc new file mode 100644 index 000000000..87574e38f --- /dev/null +++ b/docs/modules/organization/pages/sso-authentication/add-a-non-sso-user-to-an-sso-only-org.adoc @@ -0,0 +1,167 @@ += Add a non-SSO user to an SSO-only org +:navtitle: Add a non-SSO user to an SSO-only org + +When your organization enforces SSO, every user must sign in through your identity provider. To preserve a non-SSO sign-in path for a trusted admin — also called a *service account* or "backdoor user" — add that account to the non-SSO users list in your SSO settings. + +This page covers both situations: + +* The user already exists in your organization. Add them to the non-SSO users list. +* The user does not yet exist. Create them through the Kobiton API, then add them to the non-SSO users list. + +// IMAGE PLACEHOLDER 1 — enforce-users-overview.png — see "Suggested images" at the bottom of this draft. + +== How SSO enforcement affects user access + +When *Enforce users to login to Kobiton only through SSO* is enabled on the SSO settings page: + +* Every user in the organization must sign in through SSO, unless they are added to the non-SSO users list. +* Designated SSO users have their stored password removed from their account. +* The *+Invite* button on *Org Management > Users* is deactivated. New users cannot be created from the portal while enforcement is on. + +[IMPORTANT] +==== +A user whose password was removed during enforcement cannot sign in with that password later, even if enforcement is disabled. To restore email-and-password access, the user must reset their password through *Forgot password*. +==== + +// IMAGE PLACEHOLDER 2 — invite-deactivated.png + +== Scenario 1: Designate an existing user as a non-SSO user + +Use this scenario when the user already exists in your organization. + +. Sign in to Kobiton Portal as an org admin. +. Go to *Account > Settings > SSO settings* and scroll to *Verify Configuration* (panel 4). The *Enforce users to login to Kobiton only through SSO* toggle is shown to the right and green when enforcement is active. +. Under *Choose users who are allowed to login without SSO*, add the user in the *Add Users..* field. +. Save your changes. + +The user can now sign in to Kobiton with their email and password instead of SSO. + +== Scenario 2: Create a new non-SSO user (service account) + +Use this scenario when the user does not yet exist and *+Invite* is unavailable because SSO enforcement is on. Create the account through the Kobiton API, then add it to the non-SSO users list. + +The process has three parts: + +. Create the user with the *Create a member* API call. +. (Optional) Assign the Admin role if the service account needs admin permissions. +. Add the new user to the non-SSO users list in your SSO settings. + +=== Requirements + +* An existing admin account in your organization +* That admin's *username* +* That admin's *API key*, found at *Account > Settings*. Your API keys are shown at the top of the Settings page. + +Use the admin's username and API key together as Basic Auth credentials for each API call below. + +=== Step 1: Create the user + +Send a `POST` request to `/v2/organizations/members`. The default role assigned to the new user is *Member*. + +Choose whichever method is more convenient: the *Try* interface in the Kobiton API documentation, or a `curl` command in your terminal. + +==== Use the API documentation (Postman-style) + +. In the Kobiton API documentation, locate *Create a member* and click *Try*. +. Enter your admin *username* and *API key* as Basic Auth credentials. +. In the *Body Parameters* section, replace the example with the values for your new user: ++ +[source,json] +---- +{ + "email": "serviceaccount@yourcompany.com", + "enable_sso": false, + "password": "", + "username": "serviceaccount", + "first_name": "Service", + "last_name": "Account" +} +---- +. Confirm `enable_sso` is set to `false`. This is the default and must not be changed. +. Click *SUBMIT API REQUEST*. + +// IMAGE PLACEHOLDER 3 — api-doc-create-member.png + +==== Use cURL + +. Generate a Base64-encoded credential string from your admin username and API key: ++ +[source,bash] +---- +echo -n 'username:APIKey' | base64 +---- +. Run the *Create a member* request. Replace `` with the value from the previous command, and replace the body parameters with the values for your new user: ++ +[source,bash] +---- +curl -X POST \ + -H 'Authorization: Basic ' \ + -H 'Content-Type: application/json' \ + 'https://api.kobiton.com/v2/organizations/members' \ + -d '{ + "email": "serviceaccount@yourcompany.com", + "enable_sso": false, + "password": "", + "username": "serviceaccount", + "first_name": "Service", + "last_name": "Account" + }' +---- +. Confirm `enable_sso` is set to `false`. + +When the request succeeds, the new user can sign in immediately with the password you set. They do not need to confirm an email or complete SSO. + +=== Step 2 (optional): Assign the Admin role + +Skip this step if the new user only needs the default *Member* role. + +If the service account needs admin permissions — for example, to manage org settings — assign the Admin role with a `PUT` request to `/v2/organizations/members/{memberId}/assign-role`. The `memberId` is the new user's username — the value you set as `username` in Step 1. + +==== Use the API documentation (Postman-style) + +. In the Kobiton API documentation, locate *Assign a role to a member* and click *Try*. +. Enter your admin *username* and *API key* as Basic Auth credentials. +. Enter the new user's username as the `memberId`. +. In the *Body Parameters* section, set the role to `ADMIN`. +. Click *SUBMIT API REQUEST*. + +// IMAGE PLACEHOLDER 4 — api-doc-assign-role.png + +==== Use cURL + +Replace `` with the value generated in Step 1, and replace `{memberId}` with the new user's username: + +[source,bash] +---- +curl -X PUT \ + -H 'Authorization: Basic ' \ + -H 'Content-Type: application/json' \ + 'https://api.kobiton.com/v2/organizations/members/{memberId}/assign-role' \ + -d '{ "role": "ADMIN" }' +---- + +[TIP] +==== +A user can look up their own username in Kobiton Portal at *Account > Profile*. The username appears as the first value. +==== + +=== Step 3: Add the new user to the non-SSO users list + +. Sign in to Kobiton Portal as an org admin. +. Go to *Account > Settings > SSO settings* and scroll to *Verify Configuration* (panel 4). +. Under *Choose users who are allowed to login without SSO*, add the new user in the *Add Users..* field. +. Save your changes. + +// IMAGE PLACEHOLDER 5 — enforce-users-add-new.png + +== Verify + +. Sign out of Kobiton Portal. +. Sign in as the new user with the email and password you set. +. If you assigned the Admin role, confirm the *Org Management* icon appears in the portal. + +// IMAGE PLACEHOLDER 6 — org-management-icon.png + +== Related guides + +* xref:organization:sso-authentication/about-sso-authentication.adoc[] From b2e03f7e7a03ab0a6b1caac3fb28a5f3c706d4a5 Mon Sep 17 00:00:00 2001 From: tiffany-kobiton Date: Tue, 30 Jun 2026 14:44:52 -0400 Subject: [PATCH 2/6] Make PR --- .../sso-authentication/verify-and-save-configuration.adoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/modules/organization/partials/sso-authentication/verify-and-save-configuration.adoc b/docs/modules/organization/partials/sso-authentication/verify-and-save-configuration.adoc index 93bd104fc..85c656469 100644 --- a/docs/modules/organization/partials/sso-authentication/verify-and-save-configuration.adoc +++ b/docs/modules/organization/partials/sso-authentication/verify-and-save-configuration.adoc @@ -12,7 +12,7 @@ The system will open a new browser tab to the SSO login page. In this new tab, l If logged in successfully, go back to the previous browser tab with the SSO Settings opened. Wait for a while for the SSO Settings page to automatically reload (*do not force reload the page*) and a success message displays like the below: - +q image:organization:sso-verify-configuration-verified.png[width=1000, alt="The success message under Verify Configuration"] After receiving the success response, select *Save* to complete your SSO configuration. From 224b636b15cb3ce8c95f3fe4e9847de90a041489 Mon Sep 17 00:00:00 2001 From: tiffany-kobiton Date: Tue, 30 Jun 2026 15:00:38 -0400 Subject: [PATCH 3/6] KOB-51988: Style Sheriff fixes Co-Authored-By: Claude Opus 4.7 (1M context) --- ...add-a-non-sso-user-to-an-sso-only-org.adoc | 25 +++++++------------ 1 file changed, 9 insertions(+), 16 deletions(-) diff --git a/docs/modules/organization/pages/sso-authentication/add-a-non-sso-user-to-an-sso-only-org.adoc b/docs/modules/organization/pages/sso-authentication/add-a-non-sso-user-to-an-sso-only-org.adoc index 87574e38f..943ed5efb 100644 --- a/docs/modules/organization/pages/sso-authentication/add-a-non-sso-user-to-an-sso-only-org.adoc +++ b/docs/modules/organization/pages/sso-authentication/add-a-non-sso-user-to-an-sso-only-org.adoc @@ -3,7 +3,7 @@ When your organization enforces SSO, every user must sign in through your identity provider. To preserve a non-SSO sign-in path for a trusted admin — also called a *service account* or "backdoor user" — add that account to the non-SSO users list in your SSO settings. -This page covers both situations: +This page covers two situations: * The user already exists in your organization. Add them to the non-SSO users list. * The user does not yet exist. Create them through the Kobiton API, then add them to the non-SSO users list. @@ -15,8 +15,8 @@ This page covers both situations: When *Enforce users to login to Kobiton only through SSO* is enabled on the SSO settings page: * Every user in the organization must sign in through SSO, unless they are added to the non-SSO users list. -* Designated SSO users have their stored password removed from their account. -* The *+Invite* button on *Org Management > Users* is deactivated. New users cannot be created from the portal while enforcement is on. +* Kobiton removes the stored password from every user required to sign in through SSO. +* Kobiton deactivates the *+Invite* button on *Org Management > Users*, so you cannot create new users from the portal while enforcement is on. [IMPORTANT] ==== @@ -30,7 +30,7 @@ A user whose password was removed during enforcement cannot sign in with that pa Use this scenario when the user already exists in your organization. . Sign in to Kobiton Portal as an org admin. -. Go to *Account > Settings > SSO settings* and scroll to *Verify Configuration* (panel 4). The *Enforce users to login to Kobiton only through SSO* toggle is shown to the right and green when enforcement is active. +. Go to *Account > Settings > SSO settings* and scroll to *Verify Configuration* (panel 4). . Under *Choose users who are allowed to login without SSO*, add the user in the *Add Users..* field. . Save your changes. @@ -56,11 +56,9 @@ Use the admin's username and API key together as Basic Auth credentials for each === Step 1: Create the user -Send a `POST` request to `/v2/organizations/members`. The default role assigned to the new user is *Member*. - -Choose whichever method is more convenient: the *Try* interface in the Kobiton API documentation, or a `curl` command in your terminal. +Send a `POST` request to `/v2/organizations/members`. The new user receives the *Member* role by default. -==== Use the API documentation (Postman-style) +==== Use the API documentation . In the Kobiton API documentation, locate *Create a member* and click *Try*. . Enter your admin *username* and *API key* as Basic Auth credentials. @@ -109,7 +107,7 @@ curl -X POST \ ---- . Confirm `enable_sso` is set to `false`. -When the request succeeds, the new user can sign in immediately with the password you set. They do not need to confirm an email or complete SSO. +When the request succeeds, the new user can sign in immediately with the password you set. No email verification or further SSO configuration is required. === Step 2 (optional): Assign the Admin role @@ -117,7 +115,7 @@ Skip this step if the new user only needs the default *Member* role. If the service account needs admin permissions — for example, to manage org settings — assign the Admin role with a `PUT` request to `/v2/organizations/members/{memberId}/assign-role`. The `memberId` is the new user's username — the value you set as `username` in Step 1. -==== Use the API documentation (Postman-style) +==== Use the API documentation . In the Kobiton API documentation, locate *Assign a role to a member* and click *Try*. . Enter your admin *username* and *API key* as Basic Auth credentials. @@ -140,11 +138,6 @@ curl -X PUT \ -d '{ "role": "ADMIN" }' ---- -[TIP] -==== -A user can look up their own username in Kobiton Portal at *Account > Profile*. The username appears as the first value. -==== - === Step 3: Add the new user to the non-SSO users list . Sign in to Kobiton Portal as an org admin. @@ -158,7 +151,7 @@ A user can look up their own username in Kobiton Portal at *Account > Profile*. . Sign out of Kobiton Portal. . Sign in as the new user with the email and password you set. -. If you assigned the Admin role, confirm the *Org Management* icon appears in the portal. +. If you assigned the Admin role, confirm the *Org Management* icon appears in Kobiton Portal. // IMAGE PLACEHOLDER 6 — org-management-icon.png From 3cba59a63b940028eef0b9d6079e531cd20cd654 Mon Sep 17 00:00:00 2001 From: tiffany-kobiton Date: Tue, 30 Jun 2026 15:09:24 -0400 Subject: [PATCH 4/6] =?UTF-8?q?KOB-51988:=20Gatekeeper=20fixes=20=E2=80=94?= =?UTF-8?q?=20placeholders=20+=20Base64=20clarification?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Opus 4.7 (1M context) --- .../add-a-non-sso-user-to-an-sso-only-org.adoc | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/modules/organization/pages/sso-authentication/add-a-non-sso-user-to-an-sso-only-org.adoc b/docs/modules/organization/pages/sso-authentication/add-a-non-sso-user-to-an-sso-only-org.adoc index 943ed5efb..f79ecdde8 100644 --- a/docs/modules/organization/pages/sso-authentication/add-a-non-sso-user-to-an-sso-only-org.adoc +++ b/docs/modules/organization/pages/sso-authentication/add-a-non-sso-user-to-an-sso-only-org.adoc @@ -86,7 +86,7 @@ Send a `POST` request to `/v2/organizations/members`. The new user receives the + [source,bash] ---- -echo -n 'username:APIKey' | base64 +echo -n ':' | base64 ---- . Run the *Create a member* request. Replace `` with the value from the previous command, and replace the body parameters with the values for your new user: + @@ -113,7 +113,7 @@ When the request succeeds, the new user can sign in immediately with the passwor Skip this step if the new user only needs the default *Member* role. -If the service account needs admin permissions — for example, to manage org settings — assign the Admin role with a `PUT` request to `/v2/organizations/members/{memberId}/assign-role`. The `memberId` is the new user's username — the value you set as `username` in Step 1. +If the service account needs admin permissions — for example, to manage org settings — assign the Admin role with a `PUT` request to `/v2/organizations/members//assign-role`. The `memberId` is the new user's username — the value you set as `username` in Step 1. ==== Use the API documentation @@ -127,14 +127,14 @@ If the service account needs admin permissions — for example, to manage org se ==== Use cURL -Replace `` with the value generated in Step 1, and replace `{memberId}` with the new user's username: +Replace `` with the Base64-encoded credential string and replace `` with the new user's username. If you did not generate the Base64 string in Step 1, run the Base64 command from Step 1's cURL section first. [source,bash] ---- curl -X PUT \ -H 'Authorization: Basic ' \ -H 'Content-Type: application/json' \ - 'https://api.kobiton.com/v2/organizations/members/{memberId}/assign-role' \ + 'https://api.kobiton.com/v2/organizations/members//assign-role' \ -d '{ "role": "ADMIN" }' ---- From 6b5cee67ccd636aa9a144852729220646f3c1b81 Mon Sep 17 00:00:00 2001 From: tiffany-kobiton Date: Tue, 30 Jun 2026 16:48:38 -0400 Subject: [PATCH 5/6] =?UTF-8?q?KOB-51988:=20Restructure=20=E2=80=94=20task?= =?UTF-8?q?-based=20headings,=20Postman=20only?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Opus 4.7 (1M context) --- ...add-a-non-sso-user-to-an-sso-only-org.adoc | 150 ++++++------------ 1 file changed, 46 insertions(+), 104 deletions(-) diff --git a/docs/modules/organization/pages/sso-authentication/add-a-non-sso-user-to-an-sso-only-org.adoc b/docs/modules/organization/pages/sso-authentication/add-a-non-sso-user-to-an-sso-only-org.adoc index f79ecdde8..b95deefd8 100644 --- a/docs/modules/organization/pages/sso-authentication/add-a-non-sso-user-to-an-sso-only-org.adoc +++ b/docs/modules/organization/pages/sso-authentication/add-a-non-sso-user-to-an-sso-only-org.adoc @@ -1,159 +1,101 @@ = Add a non-SSO user to an SSO-only org :navtitle: Add a non-SSO user to an SSO-only org -When your organization enforces SSO, every user must sign in through your identity provider. To preserve a non-SSO sign-in path for a trusted admin — also called a *service account* or "backdoor user" — add that account to the non-SSO users list in your SSO settings. - -This page covers two situations: - -* The user already exists in your organization. Add them to the non-SSO users list. -* The user does not yet exist. Create them through the Kobiton API, then add them to the non-SSO users list. - -// IMAGE PLACEHOLDER 1 — enforce-users-overview.png — see "Suggested images" at the bottom of this draft. +When your organization enforces SSO, every user signs in through your identity provider. To keep one or more trusted accounts on email-and-password sign-in (sometimes called a service account), add them to the non-SSO users list in your SSO settings. == How SSO enforcement affects user access -When *Enforce users to login to Kobiton only through SSO* is enabled on the SSO settings page: - -* Every user in the organization must sign in through SSO, unless they are added to the non-SSO users list. -* Kobiton removes the stored password from every user required to sign in through SSO. -* Kobiton deactivates the *+Invite* button on *Org Management > Users*, so you cannot create new users from the portal while enforcement is on. +When *Enforce users to login to Kobiton only through SSO* is enabled: -[IMPORTANT] -==== -A user whose password was removed during enforcement cannot sign in with that password later, even if enforcement is disabled. To restore email-and-password access, the user must reset their password through *Forgot password*. -==== +* Every user signs in through SSO unless they are on the non-SSO users list. +* Kobiton removes each user's stored password. Users on the non-SSO users list keep their email-and-password sign-in. +* The *+Invite* button on *Org Management > Users* is disabled while enforcement is on. To add a new user, use the Kobiton API. -// IMAGE PLACEHOLDER 2 — invite-deactivated.png +If you disable SSO enforcement later, users whose passwords were removed must reset their password through *Forgot password* before signing in with email and password. -== Scenario 1: Designate an existing user as a non-SSO user +// IMAGE PLACEHOLDER 1 — enforce-users-overview.png -Use this scenario when the user already exists in your organization. +== Add an existing user to the non-SSO users list . Sign in to Kobiton Portal as an org admin. . Go to *Account > Settings > SSO settings* and scroll to *Verify Configuration* (panel 4). . Under *Choose users who are allowed to login without SSO*, add the user in the *Add Users..* field. . Save your changes. -The user can now sign in to Kobiton with their email and password instead of SSO. - -== Scenario 2: Create a new non-SSO user (service account) - -Use this scenario when the user does not yet exist and *+Invite* is unavailable because SSO enforcement is on. Create the account through the Kobiton API, then add it to the non-SSO users list. - -The process has three parts: +The user can now sign in with email and password instead of SSO. -. Create the user with the *Create a member* API call. -. (Optional) Assign the Admin role if the service account needs admin permissions. -. Add the new user to the non-SSO users list in your SSO settings. +== Create a new non-SSO user -=== Requirements +When SSO enforcement is on, the *+Invite* button is disabled, so you cannot invite new users from Kobiton Portal. To add a new non-SSO user, create the account through the Kobiton API and then add it to the non-SSO users list. -* An existing admin account in your organization -* That admin's *username* -* That admin's *API key*, found at *Account > Settings*. Your API keys are shown at the top of the Settings page. +=== Before you begin -Use the admin's username and API key together as Basic Auth credentials for each API call below. +You need: -=== Step 1: Create the user +* An existing admin account in your organization. +* That admin's username. +* That admin's API key. Sign in as the admin, then go to *Account > Settings*. Your API keys appear at the top of the page. -Send a `POST` request to `/v2/organizations/members`. The new user receives the *Member* role by default. +=== Create the user -==== Use the API documentation - -. In the Kobiton API documentation, locate *Create a member* and click *Try*. -. Enter your admin *username* and *API key* as Basic Auth credentials. -. In the *Body Parameters* section, replace the example with the values for your new user: +. In Postman, create a *POST* request to `https://api.kobiton.com/v2/organizations/members`. +. On the *Authorization* tab, set the type to *Basic Auth*: +.. In the *Username* field, enter your admin username. +.. In the *Password* field, enter your admin API key. +. On the *Body* tab, select *raw* and paste the following JSON. Replace each placeholder value with a value for the new user: + [source,json] ---- { - "email": "serviceaccount@yourcompany.com", + "email": "", "enable_sso": false, "password": "", - "username": "serviceaccount", - "first_name": "Service", - "last_name": "Account" + "username": "", + "first_name": "", + "last_name": "" } ---- -. Confirm `enable_sso` is set to `false`. This is the default and must not be changed. -. Click *SUBMIT API REQUEST*. - -// IMAGE PLACEHOLDER 3 — api-doc-create-member.png - -==== Use cURL - -. Generate a Base64-encoded credential string from your admin username and API key: -+ -[source,bash] ----- -echo -n ':' | base64 ----- -. Run the *Create a member* request. Replace `` with the value from the previous command, and replace the body parameters with the values for your new user: -+ -[source,bash] ----- -curl -X POST \ - -H 'Authorization: Basic ' \ - -H 'Content-Type: application/json' \ - 'https://api.kobiton.com/v2/organizations/members' \ - -d '{ - "email": "serviceaccount@yourcompany.com", - "enable_sso": false, - "password": "", - "username": "serviceaccount", - "first_name": "Service", - "last_name": "Account" - }' ----- -. Confirm `enable_sso` is set to `false`. +. Keep `enable_sso` set to `false`. +. Click *Send*. When the request succeeds, the new user can sign in immediately with the password you set. No email verification or further SSO configuration is required. -=== Step 2 (optional): Assign the Admin role - -Skip this step if the new user only needs the default *Member* role. - -If the service account needs admin permissions — for example, to manage org settings — assign the Admin role with a `PUT` request to `/v2/organizations/members//assign-role`. The `memberId` is the new user's username — the value you set as `username` in Step 1. +// IMAGE PLACEHOLDER 2 — postman-create-member.png -==== Use the API documentation +=== Assign the Admin role, if needed -. In the Kobiton API documentation, locate *Assign a role to a member* and click *Try*. -. Enter your admin *username* and *API key* as Basic Auth credentials. -. Enter the new user's username as the `memberId`. -. In the *Body Parameters* section, set the role to `ADMIN`. -. Click *SUBMIT API REQUEST*. +The new user receives the *Member* role by default. If they need admin permissions, assign the Admin role. -// IMAGE PLACEHOLDER 4 — api-doc-assign-role.png - -==== Use cURL - -Replace `` with the Base64-encoded credential string and replace `` with the new user's username. If you did not generate the Base64 string in Step 1, run the Base64 command from Step 1's cURL section first. - -[source,bash] +. In Postman, create a *PUT* request to `https://api.kobiton.com/v2/organizations/members//assign-role`. Replace `` with the new user's username. +. On the *Authorization* tab, set the type to *Basic Auth*: +.. In the *Username* field, enter your admin username. +.. In the *Password* field, enter your admin API key. +. On the *Body* tab, select *raw* and paste the following JSON: ++ +[source,json] ---- -curl -X PUT \ - -H 'Authorization: Basic ' \ - -H 'Content-Type: application/json' \ - 'https://api.kobiton.com/v2/organizations/members//assign-role' \ - -d '{ "role": "ADMIN" }' +{ "role": "ADMIN" } ---- +. Click *Send*. + +// IMAGE PLACEHOLDER 3 — postman-assign-role.png -=== Step 3: Add the new user to the non-SSO users list +=== Add the user to the non-SSO users list . Sign in to Kobiton Portal as an org admin. . Go to *Account > Settings > SSO settings* and scroll to *Verify Configuration* (panel 4). . Under *Choose users who are allowed to login without SSO*, add the new user in the *Add Users..* field. . Save your changes. -// IMAGE PLACEHOLDER 5 — enforce-users-add-new.png +// IMAGE PLACEHOLDER 4 — non-sso-users-list.png -== Verify +=== Verify the user can sign in . Sign out of Kobiton Portal. . Sign in as the new user with the email and password you set. . If you assigned the Admin role, confirm the *Org Management* icon appears in Kobiton Portal. -// IMAGE PLACEHOLDER 6 — org-management-icon.png +// IMAGE PLACEHOLDER 5 — org-management-icon.png == Related guides From d20078372dbc7e3991b03717b56079e9e492d104 Mon Sep 17 00:00:00 2001 From: tiffany-kobiton Date: Tue, 30 Jun 2026 17:00:31 -0400 Subject: [PATCH 6/6] =?UTF-8?q?KOB-51988:=20Style=20Sheriff=20fixes=20?= =?UTF-8?q?=E2=80=94=20Prerequisites,=20no=20"disable,"=20dedupe=20intro?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Opus 4.7 (1M context) --- .../add-a-non-sso-user-to-an-sso-only-org.adoc | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/docs/modules/organization/pages/sso-authentication/add-a-non-sso-user-to-an-sso-only-org.adoc b/docs/modules/organization/pages/sso-authentication/add-a-non-sso-user-to-an-sso-only-org.adoc index b95deefd8..18d36e3f0 100644 --- a/docs/modules/organization/pages/sso-authentication/add-a-non-sso-user-to-an-sso-only-org.adoc +++ b/docs/modules/organization/pages/sso-authentication/add-a-non-sso-user-to-an-sso-only-org.adoc @@ -9,9 +9,9 @@ When *Enforce users to login to Kobiton only through SSO* is enabled: * Every user signs in through SSO unless they are on the non-SSO users list. * Kobiton removes each user's stored password. Users on the non-SSO users list keep their email-and-password sign-in. -* The *+Invite* button on *Org Management > Users* is disabled while enforcement is on. To add a new user, use the Kobiton API. +* Kobiton turns off the *+Invite* button on *Org Management > Users* while enforcement is on. To add a new user, use the Kobiton API. -If you disable SSO enforcement later, users whose passwords were removed must reset their password through *Forgot password* before signing in with email and password. +If you turn off SSO enforcement later, users whose passwords were removed must reset their password through *Forgot password* before signing in with email and password. // IMAGE PLACEHOLDER 1 — enforce-users-overview.png @@ -26,11 +26,9 @@ The user can now sign in with email and password instead of SSO. == Create a new non-SSO user -When SSO enforcement is on, the *+Invite* button is disabled, so you cannot invite new users from Kobiton Portal. To add a new non-SSO user, create the account through the Kobiton API and then add it to the non-SSO users list. +To add a new non-SSO user, create the account through the Kobiton API and then add it to the non-SSO users list. -=== Before you begin - -You need: +=== Prerequisites * An existing admin account in your organization. * That admin's username.