A user is a person: someone who can sign in through a client registered with Versola. This
is the OAuth resource owner — the party the other two entities exist to serve. Versola
stores them once, in auth, regardless of how many tenants, clients or resources exist. For
the conceptual picture, see Entities.
- Identifiers — any combination of
email,phoneandlogin. Each is globally unique and any of them can be used to start an authentication flow. - Claims — an arbitrary JSON object of profile attributes. Which claims a given client actually receives is decided by the scopes it was granted.
- Credentials — passwords and registered passkeys.
- Roles — per tenant. A role is just a bundle of permissions; roles are what turn an
identity into an authorization decision at
edge.
Users are deliberately not tenant-scoped: one person has one identity across the whole platform. What is tenant-scoped is their roles — a user can be an administrator in one tenant and an ordinary user in another.