Invite team / organization members (b2b)

[mffap]

Preflight Checklist

• I could not find a solution in the existing issues, docs, nor discussions
• I have joined the ZITADEL chat

Describe your problem

In a standard b2b scenario I want to either invite team members by sending them a link to their email or allow them to sign-up via SSO. Currently ZITADEL doesn't offer this functionality, but only a variant that might not suit the need for b2b scenarios.

Describe your ideal solution

As Manager, I can invite users to join the organization, so I can onboard my team / users.

Considerations:

• Users can be invited by email
• The email contains a link to register for the organization from which the invite was initiated
• If SSO is enabled, I can instead sign-up with the external IDP
• Email texts can be customized
• Managers that invite team members can assign a role to the user before sending the invite (eg, engineer)
• Managers don't have to provide a password when creating an invitation
• The validity time for the invitation should be limited

Version

No response

Environment

ZITADEL Cloud

Additional Context

Related issues / discussions:

• Solution scenario for enabling team management in your app #7026
• Solution Scenario: Onboarding new organizations and users #7029
• Invite your team members #4771
• Invite users via e-mail for 3 level SaaS scenario #5563

[mffap]

@hifabienne I've opened this issue based on our discussion around strengthening the b2b use cases. When you sign-up to a new cloud service, the first user ("Admin") should have the option to easily invite their team members to join the organization. Although we have ways around it, we should make this scenario possible.

[hifabienne]

I added the issue to the road map and for the moment to the backlog.
As it requires the #6433 to be finished first, otherwise it is not possible to create users with only email addresses within ZITADEL. Without that we will not be able to fully implement this process within ZITADEL.

The onboarding guides should include how we can do this at the moment (till we do have the possiblity to create users with only the email)

[sschoeb]

I had a discussion with Fabienne in Discord about a specific "sub-feature" of this feature. So I thought I add it here so it may not get lost.

An invitation will need something that the user can be authenticated (e.g. a code). This is useful if you want to show additional information on the registrations creen for the user (e.g. his email, or the name of the organisation he is about to join). This code has to be reusable as it is a use case that a user does open the invitation but does not finish it. Therefore if he opens it a second time it should still be valid.

Here the discord conversation:
https://discord.com/channels/927474939156643850/1237018784921817089