Whenever a visitor with an active NetID or OneLink account logs in to your site, an account is created for them; their username will be their duke.edu-scoped NetID (e.g. firstname.lastname@example.org) or seven-digit Duke UniqueID (e.g. 0123456) if using OneLink. However, until this account has been assigned a role with editing privileges, they will not have the ability to do anything beyond what an anonymous (i.e. not logged in) visitor can do.
The easiest way to instantiate a user account on your site is to have the individual who needs an account login via the "NetID Login" button present on every page throughout the site. If this button is not present, then the user is already logged in and their account should exist.
Once an account has been created, users with appropriate permissions can assign one or more roles to the new account.