The ceiling: nobody grants more than they have

What this is about

Above every path on which CIAS grants permissions stands one rule:

The ceiling is not a setting. There is no switch, no role and no entry in the role catalog that turns it off.

Why is it needed? Without a ceiling, a tenant administrator could give a new colleague, or themselves, a role they never had. A single careless entry in the catalog would then be a path to every permission in the installation.

The set diagram

Picture a person’s permissions as a set. What they grant must lie entirely inside this set.

flowchart LR
    subgraph H["What Anna holds in tenant nordbau"]
      direction TB
      R1["hr-employee-read"]
      R2["hr-employee-edit"]
      A1["attribute projects = alpha, beta"]
    end
    V1["grants hr-employee-read"] -- "contained ✔" --> R1
    V2["grants projects = alpha"] -- "contained ✔" --> A1
    V3["grants hr-salary-read"] -. "not contained ✘" .-> H
    V4["grants projects = gamma"] -. "not contained ✘" .-> H

Anna may pass on what is in the box, and nothing beyond it. Whether Anna may pass it on at all is decided by delegation as well.

Delegation and ceiling are two questions

Easily confused:

Both have to agree. Neither replaces the other: having a role does not mean you may pass it on. And being on the delegation list only lets you grant what you hold yourself.

For a role grant, all refusals look the same: 403 with the text not permitted, without a reason. That way nobody can find out the installation’s rules by trial and error. CIAS writes the exact reason to the log. See Refusals that reveal nothing.

CIAS decides what you hold

The obvious idea would be to compare the roles in the caller’s token. That does not work. The token only contains the client of this deployment, and the role names appear there without their client. cdms-backend / model-editor and crms-backend / model-editor would look the same.

So CIAS calculates what you hold from its own records:

It follows that:

• A grant that starts later or has expired does not count.
• A role you have in another tenant does not count here.
• A role that someone granted by hand in the Keycloak console does not count. CIAS does not know it. You can then pass on less than you actually have. That is the safe direction.

This only works because only CIAS writes permissions into Keycloak. See The write direction.

Each variant

Attributes: when a value is “contained”

In CDMS an attribute value narrows down rows. One more value is more reach, and * turns the filter off. CIAS therefore compares exactly the way the filter reads the values: split at commas, spaces trimmed, * as “everything”.

Where the ceiling applies

Next

• Grant a role
• Who may write an attribute
• The two permission matrices: how a permission is carried