What this is about
A module no longer needs an attribute, for example because a model has lost its attribute filter. At the next reconciliation the attribute is missing from its registration. What happens then?
Why so careful? Deleting an attribute would mean destroying the value in every account. When a role is retired, only a permission is lost that can be granted again. An attribute is content. And nobody could later look up that the attribute ever existed.
Before and after
| registered | retired | |
|---|---|---|
Catalog deprecatedAt | null | date and time of the run |
Catalog module | the registering module | stays until a module registers it again |
| Entry in the user profile | there | stays |
| Values on the accounts and in CIAS | there | stay |
| Claim mapper, claim in the token | there | stay |
| Write values per tenant | according to delegation | platform administrators only |
The date stays fixed. When the reconciliation runs again, it does not restamp it. So deprecatedAt answers the question “Since when?” and not “When did the service last start?”.
The variants
When: The module that owns the attribute in the catalog answers and no longer names it. No other module in the run names it.
CIAS sets deprecatedAt. The reconciliation report lists the attribute for the module under attributeCatalogue.deprecated.
Result: retired
When: The module no longer names region, but another module in the same run does, described the same way.
As long as any module still needs the attribute, it stays registered.
Result: not retired
When: The module does not answer during the reconciliation, or its registration is rejected.
CIAS leaves everything the module owns alone. A module that is just restarting withdraws nothing.
Result: unchanged
When: The module names the attribute again later.
CIAS clears deprecatedAt and takes the description from the registration. It sets the delegation anew from the installation's statement. The values were there all along.
Result: registered again, report: reinstated
When: A retired attribute is registered by another module.
A retired attribute belongs to nobody any more. The new module takes it over and becomes the owner. The old delegation is dropped; CIAS sets it anew from the installation's statement.
Result: registered again, new owner
The decision
| Owning module answered? | Owner still names it? | Another module in the run names it? | Result |
|---|---|---|---|
| no | – | – | unchanged |
| yes | yes | – | stays registered |
| yes | no | yes | stays registered |
| yes | no | no | retired |
Really removing it
CIAS never removes an attribute, neither from the catalog nor from Keycloak. Whoever really wants to get rid of a retired attribute decides this deliberately and by hand:
- Check that no filter and no screen reads the value any more.
- Remove the claim mapper on the client and the entry in the user profile in the Keycloak console. With that, the values on the accounts are gone.
The catalog entry stays as proof that the attribute existed.