lumo users identities / lumo identities
Manage the federated identities that sign in as a user — a SAML identity provider + NameID, an LDAP directory + DN, or a social provider — and relink users whose SAML link predates per-IdP binding. The commands call the Federated identities endpoints of the Admin API.
lumo users identities list jane@acme.com
lumo users identities link jane@acme.com --saml-idp 7 --name-id jane@acme.com
lumo users identities link jane@acme.com --ldap-config 1 --dn "uid=jane,ou=people,dc=acme,dc=com"
lumo users identities unlink jane@acme.com --type ldap --yes
lumo identities legacy-saml
lumo identities legacy-saml --idp 7 --relink --dry-run
lumo identities legacy-saml --idp 7 --relink --yes
A link decides who can sign in as the account, so every change signs the user out everywhere, emails them, and is audited (identity.link.created, identity.link.removed, identity.link.bulk_relinked). You need the users.edit permission (API keys: admin:users:write; list and the report only need read access), and you cannot change the links of an account that holds permissions you lack. See Relinking federated identities.
users identities list <user>
Prints each link: type, source (IdP or directory name and id), the identity (NameID, DN or provider subject) and notes such as legacy, LDAP only or orphaned (its IdP or directory was deleted). -o json passes the API response through.
users identities link <user>
| Flags | Links |
|---|---|
--saml-idp <id> --name-id <nameid> | A SAML identity: the NameID the IdP asserts for the user |
--ldap-config <id> [--dn <dn>] [--ldap-only] | An LDAP identity. Without --dn the server searches the directory by the user's email, then username. --ldap-only also disables the local password |
--mfa-challenge <id> | Id of an approved step_up challenge — needed with lumo login tokens, not with API keys |
A new link replaces the user's existing link of that type. The command fails without calling the server when the flags are incomplete or mix SAML and LDAP. The server refuses with 409 identity_conflict when another user already holds that identity, or when the user is linked to a different federated source — unlink it first.
users identities unlink <user> --type saml|ldap|social
Removes the link. Asks for confirmation on a terminal; scripts pass --yes (without a terminal and without --yes it refuses and sends nothing). Unlinking LDAP also re-enables the local password, which the user usually needs to reset.
identities legacy-saml
Users whose SAML link stores a bare NameID (from before links named their IdP) are refused at SAML sign-in while the organization has more than one SAML IdP. Without --relink the command prints them with the IdP whose Allowed email domains claim their address (--idp <id> keeps only that IdP's users).
| Flag | Meaning |
|---|---|
--idp <id> | Filter the report; required with --relink — the IdP that issues these users' NameIDs |
--relink | Rebind the users to --idp, keeping their NameID |
--user <id> | With --relink: only these users (repeatable). Default: every legacy user the IdP's email domains claim |
--dry-run | With --relink: show the plan, change nothing |
--yes | With --relink: apply without a confirmation prompt (required without a terminal) |
--mfa-challenge <id> | Approved step_up challenge for lumo login tokens |
Users you do not outrank, or whose NameID is already linked to someone else at that IdP, are listed as skipped with the reason.
Errors
| Error | Meaning / fix |
|---|---|
step_up_required (403) | Signed in with lumo login: approve a step-up challenge and pass --mfa-challenge, or use an organization API key |
identity_conflict (409) | The identity belongs to another user, or the user has another federated link — check lumo users identities list and unlink first |
directory_lookup_failed (422) | The directory search found nothing or failed — pass --dn |
forbidden (403) | The account holds permissions you do not have |