Platform Administration - Restrict local user creation through API

Administrators need a platform-level control to restrict or prevent local user creation through API or CLI tooling when the user is intended to be managed by a configured SAML identity provider.

While testing CPDCTL functionality, it was identified that a user can be created through the CLI and then appear in the Cloud Pak for Data platform as a SAML provider user. This behavior may allow user records to be created outside the intended identity provider workflow, bypassing the expected process where SAML-authenticated users are introduced to the platform only through the configured identity provider and approved SSO flow.

The requested enhancement is to provide a supported administrative control that prevents or restricts the creation of SAML provider users through CLI-based or API-based user creation unless the action is explicitly authorized and validated by platform policy.

Ideally, user creation for SAML-authenticated accounts should be controlled exclusively through the configured identity provider, or governed by platform-level validation that ensures users cannot be created outside the intended SSO process.

Requested capabilities include:

• Prevent creation of SAML provider users through CPDCTL, API, or other CLI-based user-management methods.

• Provide an administrative setting to enforce SSO-first-login-only user creation.

• Ensure SAML-authenticated users can only be created or activated after successful authentication through the configured identity provider.

• Add platform validation to prevent CLI or API creation of users that are associated with a SAML identity provider unless explicitly permitted.

• Provide role-based controls to determine who, if anyone, can create users outside the identity provider flow.

• Add audit logging for user creation events that identifies whether the user was created through SSO, UI, API, CLI, or another mechanism.

• Provide reporting or administrative visibility into users created outside the SAML SSO workflow.

• Optionally provide a policy setting to block user creation methods that do not originate from the configured identity provider.

There is currently no hard workaround to enforce “SSO first login only” as the exclusive method for creating a user entry in CPD. The only available mitigations are to limit user-management authority to the smallest possible administrator scope and periodically review CPD users against the identity provider list to identify and remove accounts that were created outside the intended SSO flow.

This enhancement is needed to improve platform administration, identity governance, and access control. Organizations that rely on SAML-based SSO need assurance that platform users are created only through the authorized identity provider workflow and not through alternate CLI or API paths. Without this control, administrators must rely on manual reviews and after-the-fact cleanup, which introduces operational overhead and potential governance risk.

Providing a platform-level restriction for SAML provider user creation would help ensure that CPD user management remains aligned with enterprise identity provider policies, reduce the risk of unauthorized or unintended account creation, and strengthen administrative control over identity lifecycle management.