Upcoming changes to the user system
Added 2020-05-29 10:53:43 +0000 UTCOne of the issues that has come up as people have been using AMP more and at larger scales is that of the same username existing in multiple places, or rather - the inability to do this.
Right now if you create a user inside a single instance, that username cannot be used anywhere else. So you couldn't then use it in a completely unrelated instance - which is inconvenient especially for Enterprise deployments.
So the change that's going to happen is that for ADS setups with multiple instances, the following rules will apply:
- If a user is created within a specific instance, that same username can be used on other individual instances. However that username can no longer be used within ADS.
- If a user is created within ADS, that username can no longer be used within a specific instance.
If you try to create a user from ADS that is 'occupied' it will give an error showing which instance currently has ownership of that user.
If you try to create a user from within a single instance that is 'occupied' it will give a more generic message saying that this username cannot be used without explicitly saying that it belongs to a user within ADS.
This combination of rules keeps the consistency where a user who logs into ADS can still have instance-specific permissions, but doesn't prevent instances that are controlled by unrelated people from creating users in such a way that the username is consumed globally.
Additionally for Enterprise users, we're going to introduce new settings to limit the total number of roles and users that a single instance is permitted to have.
