The admin interface

When: /access/tenants and /access/tenants/{key}

The list shows every tenant with its business standing, provisioning, validity and the number of people with this home tenant. Create tenant asks for name, key, type (“Organization” = dynamic, “Static”), for “Organization” the organization in the identity provider (prefilled with the key), and the validity. Edit changes only the validity. The detail page shows all four standings side by side. Activating is only possible after provisioning has finished. For a suspended tenant, the same button resumes it. Closing asks first.

Result: See Creating and provisioning a tenant and Suspending, closing, validity.

When: /access/users and /access/users/{id}

The list shows all people across all tenants, with filters for tenant and status. Buttons per row: Activate, Suspend and Close (both with a reason), Edit (display name, home tenant, groups, project access). Adopt from IAM fetches accounts from Keycloak that CIAS does not know yet. The detail page shows directly granted roles and roles inherited through groups, Grant role (with tenant for tenant roles, end date, reason), Revoke (with reason) and the CIAS attributes. There is no “Create user” button.

Result: See Suspend, unsuspend, close, Granting a role.

When: /access/registrations

By default the queue shows the open attempts: Awaiting approval, Awaiting verification and Failed. “All” shows every state. The buttons depend on the state: Approve and Reject (with reason) for “Awaiting approval”; Set up again and Discard for “Failed”; Activate and Discard for “Awaiting verification”.

Result: See Approval by an administrator and Cleaning up abandoned registrations.

When: /access/mail-templates

The page lists the seven registration mails per language (German, English) with their default, as “Shipped” or “Own version”, and below them the wording of individual tenants. Edit opens an editor with subject, text, an HTML switch, the mail's placeholders (plus application and flow) and an optional tenant. The page marks unknown placeholders before saving. Reset gives a default the shipped text again; a tenant's wording is deleted, after which the default applies to it.

Result: See Editing templates.

When: /access/groups

The list is searched in CIAS and loaded page by page. Create group and Edit ask for name, key (fixed after creation), description, roles from the catalog and whether it is the default group. You add or remove members through a person search. On top there are Delete, Adopt from IAM and Reconcile with IAM. Groups with module roles get a notice that these roles do not apply in dynamic tenants.

Result: See Managing groups and members and Group roles under dynamic tenants.

When: /access/roles

The role catalog, read only, organized by the module that declared the role, with search and filters by origin and scope. Roles for the context switch are in a separate notice box. Reconcile with the modules starts the reconciliation and shows the report per module.

Result: See The role catalog and Reconciliation with Keycloak.

When: A signed-in person without platform-admin.

The area “Access” is missing from the menu. If the person opens a page by its address, the BFF already refuses, and the page shows “Missing permission – the role “platform-admin” is required”.

Result: No data, no calls to CIAS.

When: The installation requires a tenant, and the request has none.

The menu is empty. Above every page it says “No tenant assigned” with the signed-in name. Only the settings and sign-out stay reachable.

Result: An administrator assigns the account to a tenant, then a new sign-in is enough.