User write stage
The User Write stage writes data from the current flow context into a user object.
About the user write stage
This stage updates the current pending_user, or creates a new user if the flow does not already have one and the configured creation mode allows it.
It is commonly used in enrollment, recovery, and profile-update flows after a Prompt stage has collected input into prompt_data.
Configuration options
- User creation mode: control whether the stage never creates users, creates them only when required, or always creates them.
- Create users as inactive: mark newly created users as inactive.
- Create users group: optionally add newly created users to a specific group.
- User type: select the user type for newly created users: Internal, External, or Service Account.
- User path template: optionally set the path new users will be created under. If left blank, the default path will be used.
Data written to users
The stage reads values from prompt_data in the flow context. The key tells the stage where to store each value:
| Prompt data key | Result on the user |
|---|---|
username | Sets the built-in username. |
name | Sets the built-in display name. |
email | Sets the built-in email address. |
password | Sets the user's password. |
attributes | Merges a dictionary into the user's attributes. |
attributes.<key> | Sets a custom user attribute. |
attributes.<group>.<key> | Sets a nested custom user attribute. |
For example, prompt fields with the keys attributes.given_name and attributes.family_name produce these user attributes:
family_name: Roy
given_name: Dominic
Use attributes.<key> for custom attributes. The stage does not write other keys, such as department, to the user; their values remain in prompt_data until the flow ends, available to later stages and policies.
For a complete configuration procedure, see Collect custom user attributes during enrollment.
Flow integration
Use this stage after one or more stages that populate flow context, usually an Identification stage, Prompt stage, or Email stage.
In enrollment flows, this stage is often followed by a User Login stage so the newly created user is immediately signed in.
Notes
Invitation data
An Invitation stage adds the invitation's built-in properties and custom attributes to prompt_data. The User Write stage stores an attributes dictionary or dotted keys such as attributes.department in the same way as submitted prompt values. For more information, see Invitations.
Dynamic groups
To add users to dynamic groups, set groups in the flow plan context before this stage runs. The value must be a list of actual Group objects:
from authentik.core.models import Group
group, _ = Group.objects.get_or_create(name="some-group")
request.context["flow_plan"].context["groups"] = [group]
return True