starter.wiki搜索⌘KEN

任务决策

用户管理：决定谁拥有用户记录与生命周期

选择账户资料、邀请、删除、支持操作和审计事件的系统边界。

Recommendation

将应用关键用户数据保留在自身数据库，把认证服务作为身份和会话来源。

区分身份提供商记录与应用用户域；两者可以关联但不应相互替代。126

适用范围： Teams defining user lifecycle and administrative ownership

Main trade-off

双层模型需要同步设计，但能降低迁移风险并保持业务灵活性。12

选择标准

按真实约束逐项判断，不要只比较功能列表。

  1. Source of truth

    Name the authoritative store for credentials, profile data, and employment or membership status.126

  2. Administration

    Decide whether product staff, customer admins, or enterprise directories create and deactivate users.35

  3. Lifecycle automation

    Determine whether invitations, suspension, deletion, and provisioning must be automated.36

  4. Domain depth

    Keep product-specific fields and workflows outside a generic identity profile when they carry business meaning.14

适用路线

这些条件会改变默认答案；请在作出承诺前逐项验证。

Integrated application identity

Use Clerk or Auth0 for the managed identity record while the application stores domain profile data.

This reduces authentication operations without forcing all product state into the identity provider.

Verify: Do not treat provider metadata as the full application data model.14

Enterprise directory lifecycle

Use WorkOS when customer directories and provisioning are the authority.

Directory-driven creation, updates, and deactivation need an enterprise identity integration boundary.

Verify: The application still owns product entitlements and domain state.36

B2B customer administration

Evaluate Frontegg when tenant admins need a broader packaged administration surface.

Tenant-oriented identity administration can reduce the work of building customer-facing management workflows.

Verify: Validate how far its tenant model matches the product domain.5

Application-owned lifecycle

Keep the domain user record in the application and integrate identity by stable subject ID.

This preserves control when onboarding, status, entitlements, or compliance workflows are product-specific.

Verify: The team owns administration, data quality, and lifecycle automation.6

边界： User management does not replace authentication, authorization, organization-domain modeling, or product entitlements.

关键差异

把真正会改变决策的边界单独比较。

Identity versus profile
Credential identity and session state are not the same as a product's user profile.14
Provisioning authority
Enterprise directories can become authoritative for activation and deactivation.36
Tenant administration
B2B products often need customer-admin workflows beyond basic identity records.15
Exit cost
More lifecycle state stored in a provider increases migration work.12

官方资源

官方文档与继续决策的正式路径。

来源

支撑页面关键主张的资料。

  1. 1
    Clerk user management

    Clerk · Accessed Official

  2. 2
    WorkOS users and organizations

    WorkOS · Accessed Official

  3. 3
    WorkOS Directory Sync

    WorkOS · Accessed Official

  4. 4
    Auth0 Management API

    Auth0 · Accessed Official

  5. 5
    Frontegg user management

    Frontegg · Accessed Official

  6. 6
    RFC 7644: SCIM protocol

    IETF · Accessed Official