Skip to main content
Enterprise feature. This entire page — user/department/team management, SSO group mappings, and Entra ID directory sync — is nasiko-ee only. The open-source edition has a much smaller surface: basic account creation/deactivation via /api/users (superuser-gated), with no departments, teams, roles, or directory sync.
Administrators manage users, departments, and teams through the admin CLI (nasiko-ee) or the equivalent API routes.

​
Creating a user

No password is set. The platform returns a one-time key pair:
access_secret is shown once and is the user’s initial login password. There is no recovery endpoint — if lost, an admin resets the account.
--role defaults to member. Place the user at creation time:
Add --superuser for superuser privileges (separate from --role — see below). Move or remove users later:

​
Role vs. superuser

They’re checked separately everywhere. role: admin does not grant superuser. Set it with --superuser at creation, or on the Users page afterward.

​
Departments and teams

A department contains teams; a team belongs to exactly one department. Creating, updating, or deleting either requires superuser.
Assigning a --manager or --lead does not change that user’s role. Bump it separately if they need the matching permission tier.

​
Single sign-on and automatic placement

Nasiko supports OIDC SSO with any standards-compliant provider. See SSO setup. Group-to-role mapping works with any OIDC provider that emits a group claim. Map an external group to an internal role, team, and/or department; it applies on sign-in. A user matching several mappings gets the highest-ranked role’s mapping applied in full — rows are not merged field by field. A user matching none keeps their current role, so manual promotions are never reset. Directory sync pre-provisions your whole hierarchy before anyone logs in. It requires Microsoft Graph and is Entra ID only.
It infers the hierarchy from each user’s department attribute and manager chain: the person with no in-department manager becomes department head, their reports who manage others become team leads, everyone else joins the nearest lead’s team. Users with no department attribute become plain members. Sync is insert-only and safe to re-run — it never touches a user it already created, and never reverts a manual placement. If your directory changes significantly, reassign affected users by hand.
A user who signs in via SSO with no mapping or sync record lands as a plain member with no team or department. An admin promotes and places them afterward.

​
Next