Add users to Ganymede¶
Status: Current | Last reviewed: 2026-09-16
Use Add Users to Ganymede on the Ganymede → Home tab to find a person by work email, create missing Salesforce or Authentik accounts, and add missing Ganymede group membership.
Get access¶
Ask a Salesforce administrator to assign you the Ganymede Administrators permission set. The component is hidden without that permission set. Refresh Salesforce after the assignment.
Administrators can also place the component on a Lightning Home or App page, or add the Add Users to Ganymede tab to an application's navigation.
Add a person¶
- Enter their work Email address and select Search.
- Review the Salesforce and Authentik statuses.
- If Salesforce is missing, enter First name and Last name. If Salesforce already has the person, those names appear read-only.
- Select the creation action shown for the missing accounts. If an existing Authentik account needs the Salesforce Users group, select Grant Ganymede access or Create in Salesforce and grant Ganymede access.
- Wait for confirmation that the person exists in both systems with the required Salesforce Users group.
For example, adbhalerao@deloitte.com maps to Salesforce username adbhalerao@trueserve.com and Authentik username adbhalerao.
New Salesforce users receive the Ganymede User profile and Ganymede Access permission set. New Authentik users join Ganymede Only Users and Salesforce Users. The workflow does not send a welcome email or set a password; use your organization's existing SSO sign-in process.
If both accounts exist but Authentik shows Exists — missing Salesforce Users group, use Grant Ganymede access. The component adds the missing membership and preserves their other groups. Existing Authentik users are not added to Ganymede Only Users, because that group would block their other applications.
When both accounts and the required membership already exist, no changes are needed. The component does not change existing Salesforce profiles or permission sets, reactivate accounts, or override other Authentik access policies.
Resolve a blocked request¶
- Duplicate email or username conflict: ask the Salesforce or identity administrator to review the existing accounts. The component does not choose between people who share an email or the same email prefix.
- Inactive account: ask an administrator to review the inactive account before proceeding.
- Federation ID mismatch: ask the Salesforce administrator to check the person's SSO identity.
- Authentik connection error: ask the identity administrator to check the connection. Search again before retrying.
- Authentik Permission Denied at sign-in: search the email again and grant any missing Salesforce Users membership. If it is already present, ask the identity administrator to check the user's Ganymede application policies.
- Salesforce creation failed after Authentik succeeded: the Authentik account is retained. Ask the Salesforce administrator to resolve the displayed error, then search again and create the missing Salesforce account.
Editing the email clears the previous result. You must search the new address before creating accounts.