How do I create a User that have two signatory User and its creator i.e System User

I am trying to create User But it show me this error

create of User:User at DA.Internal.Prelude:381:26
failed due to a missing authorization from Bob
here is my sample template

template SystemUser
        with
            name : Text
            systemUser : Party
        where
            signatory systemUser 

     nonconsuming choice CreateUser : ContractId  User
             with
                _profileId :   Int
                _code : Optional Text
                _name : Optional Text
                _email: Optional Text
                user : Party 
            controller systemUser
             do create  User with
                  profileId =  _profileId 
                  code =   _code
                  name =   _name
                  email =   _email
                  status = _status
                  user 
                  systemUser  

type UserKey = (Party, Int)

 template User
    with
        profileId : Int
        code : Optional Text
        name : Optional Text
        email: Optional Text
        status : Text
        user : Party
        systemUser : Party
 where
    signatory [systemUser , user]  

    key ( user, profileId ) :   Userkey
    maintainer key._1

here is my scanerio

systemUser <- getParty "Alice"
user  <- getParty "Bob"

   uid <- submit systemUser do
        create SystemUser
            with
                name = "Alice"
                systemUser

asid <- submit systemUser $ exercise  uid  CreateUser
    with
      _name = Some  "Bob" 
      _profileId =    1  
      _code = Some "ATL"
      _email = "abc@gmail.com"
      user

Hi!

First, the error message you gave doesn’t tally up with the scenarios - it mentions a AssociateUser, whereas your example has SystemUser. Can you check these are consistent?

Second, looking at your code example, the createUser choice sets the user field to that passed as an argument. I don’t think this is allowed; otherwise, you would have an authorization loophole - you could just pass any old party to that choice. Instead, Bob should explicitly give their consent to the creation of this contract, by using e.g. a propose/accept pattern.

Updated

But is there any other way to create User without proposal/accept pattern because I want to create User without his permission. And proposal accept pattern involve approval from both parties.

In DAML, you can never force someone to signing a contract unless they agreed to it. If you don’t want the user to agree, they cannot be a signatory of the contract.

Perhaps it’s enough just to remove Bob from the User.signatories, given you description of the behaviour you want.

But if I want to fetch user by key than how do I do this?

You can still make the user part of the key but you need to include the system user as well. So something like

key (systemUser, user, profileId) : (Party, Party, Int)