organization & teams

6 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Organization provisioning basic configuration

Basic organization provisioning configuration: `organizationProvisioning: { disabled: false, defaultRole: 'member' }`. This enables organization provisioning and sets the default role for new members to 'member'.

Organization provisioning with custom role assignment

Advanced organization provisioning with `getRole` function for custom role assignment based on SSO attributes: ```ts organizationProvisioning: { disabled: false, defaultRole: "member", getRole: async ({ user, userInfo, provider }) => { const department = userInfo.attributes?.department; const jobTitle = userInfo.attributes?.jobTitle; if (jobTitle?.toLowerCase().includes('manager') || jobTitle?.toLowerCase().includes('director') || jobTitle?.toLowerCase().includes('vp')) { return "admin"; } if (department?.toLowerCase() === 'it') { return "admin"; } return "member"; }, } ```

Linking SSO providers to organizations

When registering an SSO provider via `registerSSOProvider`, you can link it to a specific organization by providing `organizationId` in the request body. Users who sign in through this provider are automatically added to that organization. When the organization plugin is enabled and organizationId is supplied, the caller must be an organization owner or admin; regular members receive a 403 FORBIDDEN response.

Organization provisioning flow sequence

The organization provisioning flow follows this sequence: (1) User signs in through an SSO provider linked to an organization, (2) User is authenticated and either found or created in the database, (3) Organization membership is checked - if the user isn't already a member of the linked organization, (4) Role is determined using either the defaultRole or getRole function, (5) User is added to the organization with the determined role, (6) User provisioning runs (if configured) for additional setup.

Domain verification enables automatic organization assignment

Domain verification is also required for automatic organization assignment after a user signs in through another identity provider, such as a social provider. Better Auth uses the stored user's verified email and assigns an organization only when the verified domain maps to exactly one organization.

Automatic SSO provisioning does not process pending invitations

Automatic SSO provisioning does not accept or cancel pending invitations. An invited user must complete the existing invitation flow before Better Auth creates an automatic membership for the same organization.

Give your agent this brain