Repository navigation
Document accepting an organization invitation through an identity provider - #52755
Conversation
6c8bb3b to
3dc5547
Compare
There was a problem hiding this comment.
🟡 Changes recommended
The documentation must clarify that already-linked identity-provider accounts do not accept invitations through this flow.
Get a fresh assessment by requesting another Copilot review.
Pull request overview
Documents accepting organization invitations through first-time identity-provider login.
Changes:
- Explains unmanaged membership and email matching.
- Warns that the broker choice is unrestricted.
- One documented claim overlooks already-linked broker accounts.
File summaries
| File | Description |
|---|---|
docs/documentation/server_admin/topics/organizations/managing-members.adoc |
Adds identity-provider invitation guidance. |
Review details
- Files reviewed: 1/1 changed files
- Comments generated: 1
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
3dc5547 to
ffc222b
Compare
There was a problem hiding this comment.
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Pull request overview
Copilot reviewed 1 out of 1 changed files in this pull request and generated 3 comments.
| IMPORTANT: Anyone with the invitation link who creates an account through any identity provider using the invited email address | ||
| joins the organization. |
There was a problem hiding this comment.
🟡 Changes recommended
The documentation incorrectly implies every realm identity provider can consume invitations regardless of its configured first-login flow.
Get a fresh assessment by requesting another Copilot review.
Review details
- Files reviewed: 1/1 changed files
- Comments generated: 1
- Review effort level: Balanced
| completes, but only if the email of the account matches the email address used to send the invitation. A user already linked to the | ||
| identity provider they choose skips that flow, so the invitation is not accepted and stays pending until it expires. | ||
|
|
||
| IMPORTANT: The invitation is accepted through any identity provider in the realm, not only those associated with the organization. |
…vider The invitation docs only described the registration form. Explain that the invitee can return to the login page and authenticate through an identity provider instead, that the resulting membership is unmanaged, and that the email of the account has to match the address the invitation was sent to. Note that the invitation is accepted through any identity provider in the realm, and that a user already linked to the provider skips first broker login, so the invitation stays pending until it expires. Signed-off-by: Alexis Rico <sferadev@gmail.com>
fb2e5f2 to
8150c20
Compare
Follow-up to #52183, as requested in #52183 (comment)
Mentions in the invitation docs that an invitee can also sign up through an identity provider, that the membership is unmanaged, that the account email has to match the invitation, and that the link plus that email is enough to join whichever identity provider was used.
Relates to #52181