Can I specify any string for the SecurityMemberId value? (and roleId)

kudo

When registering a new user or role through the AxonIvy cockpit, the SecurityMemberId in the IWA_SecurityMember, IWA_User, and IWA_Role tables in the database is registered with a string in the format "USER-xxxxxxxxx-xxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" or "ROLE-xxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx." If I register a string pattern that doesn't follow this format as the SecurityMemberId, will this affect operation? (Are there any internal operations that depend on this format?)
For example, would it affect operation if I set the SecurityMemberId for the user to "XX_YY_ZZ user001" or "一人目のユーザー" and the SecurityMemberId for the role to "XX_YY_ZZ role001" or "１つ目のロール"?

(Background of the question)
Currently, in order to quickly register a large number of users and roles, I execute SQL directly against the database to register them all at once.
(For users, I use SQL to insert data into the IWA_SecurityMember, IWA_User, and IWA_UserRole tables, and for roles, I use SQL to insert data into the IWA_SecurityMember and IWA_role tables.)
In this case, I would like to specify an arbitrary string assigned by me as the SecurityMemberId.

The table specifications allow any VARCHAR for SecurityMemberId, so I think strings that do not follow the USER-xxx or ROLE-xxx format shown above should be acceptable. However, if I use a string that does not follow these formats, it will cause problems if it doesn't work, so I would like to confirm this in advance just to be sure.

Similarly, for the roleId in the IWA_Role table, is it okay to specify any value within the BIGINT range as long as there are no duplicate values?

I would appreciate your response to the above two questions.

Alexander Suter

kudo Making manual changes directly in the system database is not a good idea. There are several reasons for this:

The database contains redundant data to enable fast queries, which means all related entries must be updated consistently.
The database structure may change with each major or minor update, requiring you to continuously adjust your custom SQL scripts.

In addition, the SecurityMemberId field only supports values starting with USER- or ROLE-; other prefixes are not allowed. The recommended approach is to use the official Axon Ivy API. Could you share your specific use case and give an estimate of how many users and roles you need to manage?

kudo

Thank you for your response.

Could you share your specific use case and give an estimate of how many users and roles you need to manage?

We are currently using a system that supports this scale of users and roles:

users: approximately 100,000
roles: approximately 50,000 to 65,000

Users are expected to connect via SSO using OpenIDC, and roles are intended to represent the groups currently used in our existing system.

Please let us know if you require any additional information.

Alexander Suter

kudo Is this a onetime operation on production system or is this import needed for testing and will be repeated? I think doing it as onetime operation, takes some time, but probably should be good enough, already? If you need to repeat it for test environment, then I would do it once and backup/restore the database for each setup.

kudo

We plan to register all data initially as a one-time operation, and thereafter perform daily incremental updates for users and groups where changes have occurred.

I think doing it as a one-time operation takes some time, but probably should be good enough, already?

While we understand that the initial registration may take some time, would it be possible for you to provide a rough estimate of the expected processing time for users and roles, assuming there is no hierarchy or parent-child relationship among roles, given the following volume?

Number of users: approximately 100,000
Number of roles: approximately 50,000 to 65,000

The recommended approach is to use the official Axon Ivy API.

Could you please let us know what information is required to register and update users and roles using the official API?

Alexander Suter

kudo How long it takes, depends on your environment (Hardware, Network Latency, ...). You can use the IUserRepository and IRoleRepository to create the identities, these are available via ivy.security.roles and ivy.security.users.