Guest users
In the case that you want to have users in your instance that can only act as
collaborators of trusted users, we provide the concept of "Guest Users".
They have an account (either local or from OIDC/LDAP/SAML) but do not have
permission to create projects in any way. A message will be shown to them
stating that they do not have enough permissions.
However, they can still be invited as collaborators or via link-sharing from
other projects.
In the admin panel, they are shown in gray, and can be selected directly using
the "Guest users" tab.
Configuring
You can manually assign the role of "Guest user" when creating a new account
via the admin panel. You can also modify a current user to remove/add the guest
user role.
If using OIDC, you can map a user role to a guest user. For example:
In this case, if the OIDC user has the role guest, it will be automatically
marked as a Guest User. This is checked at every login, so changes in your OIDC
provider role will be synchronized.