User management
The user record in CIAS from the subject area view: status, suspend, close, move, maintain attributes, and why the order of the write operations decides security.
Topics in this subject area
- 1.The user record
Why CIAS keeps its own record next to the Keycloak account, what it contains, and what it never contains.
- 2.The lifecycle of a user
PENDING, ACTIVE, SUSPENDED, CLOSED: every transition and why CLOSED is final.
- 3.The write order
When revoking, Keycloak first; when granting, CIAS first. Why exactly this way round, and what happens if something fails in between.
- 4.Suspend, reactivate, close
The three status operations step by step, and the fact that closing disables the account but does not delete it.
- 5.Import existing accounts
How CIAS imports Keycloak accounts it does not know yet as users.
- 6.Rename and change the home tenant
What happens when you rename a person or change their home tenant, and the fact that the membership in Keycloak does not move along.
- 7.Maintain a person's attributes
The three storage locations for attributes (CIAS-internal, Keycloak profile, per tenant) and who may write what.
- 8.Resend the password setup link
How an administrator sends a person a new link to set their password.
- 9.Self-service: own tenant and language
What a signed-in person can look up and change about themselves.