Issues in creating user via API

[cladius_fernand]

Hi,

I am using Apigee on prem Version 4.19.01.00. My goal is to create a custom role and have a dummy user associated with that role i.e. it will not be backed by a valid email address, so I will have to set the password via the api.

Approach 1:

1. Create the custom role.
2. Create a user via the Edge UI and associate the role to the user. (Note: I cannot set the password in this step)
3. Update/Set the password for the user via an api call.

On this last step I encounter the following error:

{
    "code": "usersandroles.UserDoesNotExist",
    "message": "User custom.role2@domain.com does not exist",
    "contexts": []
}

which is strange as I can see the exact email address in the Org Users page. Also if I try to create a user via the API using the same email address it complains saying:

{
    "code": "usersandroles.EmailIdAlreadyExists",
    "message": "EmailId:custom.role2@domain.com already exists",
    "contexts": []
}

Strange.

Approach 2:

1. Create the custom role.
2. Create the user via the api (This way I can set the password for the user but not from the UI. Hmmm!)
3. The user is not visible in the Org Users page (probably a "feature") as it is not associated with any roles yet.
4. Associate the user with the role via an api call
5. Try to view the user on the Edge UI

At this step, the UI runs into some error and shows me the following error messages at the top:

Error fetching Userroles, Error fetching User
Open to view all 2 messages
Dismiss All
×   Error fetching Userroles
User customrole4@domain.com does not exist.
×   Error fetching User
User customrole4@domain.com does not exist.

Am I doing something wrong here? Or are these defects?

[cladius_fernand]

Minor point regarding Approach 2: point 3:

Once I created multiple orgs on the same hardware infrastructure (or planet) I realized why this is designed the way it is. Due to the multi-tenant nature of Apigee Edge, an org user does not actually exist at the org level but rather at the planet level. It is shared across or at least made available to all the orgs on the planet. If the org user has at least one role for a specific org, then the user is listed in the org users for that org. This feature indeed makes sense.