Directory

TrakState keeps no passwords. Who a user is, the directory knows; what they may do, TrakState knows. User management blends the two halves: email, name, security role and status come from the directory, the assigned roles from the tenant.

That split is why some actions are available in one installation and not in another: they depend on which directory is active.

The three directories

Directory	Active when	What it can do
Fixture	development environment only	a fixed cast of demo users; read and write
Identity provider	saas and on-prem, once the instance has a directory credential of its own	the tenant’s real users; read and write
Tenant database	the same profiles, while that credential is missing	the same users; read only

The choice follows the operating profile (PRODLOG_PROFILE); an explicit switch (USER_DIRECTORY) takes precedence. Both belong to the installation and are described in the chapter Installation and operation.

A production installation refuses to start if the demo directory would be active — whether because a value is missing or because it is mistyped. Startup aborts with a message naming the value to set. That way a customer never sees a list of invented users.

The instance’s own directory credential

Every instance is given a machine user of its own in the identity provider when it is provisioned, and that machine user belongs to this tenant’s organisation and to no other. It is what lets the instance manage its own users - and what makes reaching a different organisation impossible, because the identity provider refuses it rather than us remembering not to ask.

It is created during provisioning. Tenants that existed before this arrived are given one on the next rollout.

What is missing without it

Without that credential the instance falls back to the tenant database, and user management is then a view. You see the list, the detail and the roles; every changing action is refused and a notice stands where the buttons would be. New users are created in this case by the operator level, when the tenant is set up.

Two fields are makeshift in this mode and should not surprise you:

• The name is the part of the email address before the @ (anna.klein@example.com becomes anna.klein), because the database carries no name columns.
• The status is always active; there is no deactivation on this route.

The bar applies to every changing action on the page — including assigning and removing roles, even though a role lives entirely in the tenant and has nothing to do with the directory. In this mode, who holds which role therefore stays as it is until the directory can be written to.