Creation by the platform administrator

What this is about

Sometimes support creates an access by hand, for example for a customer who should not register themselves. For this there is the variant PLATFORM_ADMIN: a registration that a signed-in administrator starts for another person.

The person still gets an email with a link and verifies their address themselves. So the administrator does not create a finished account. They start the registration.

Turning on the variant

PLATFORM_ADMIN is available only when the installation configures the flow. An example:

codamai:
  cias:
    registration:
      flows:
        PLATFORM_ADMIN:
          enabled: true
          tenant-assignment: FROM_PAYLOAD
          required-caller-roles: [platform-admin]
          token-ttl: P7D
          fields:
            - { key: email, type: EMAIL, required: true }
            - { key: firstName }
            - { key: lastName }

required-caller-roles sets which roles the caller must have. Without this entry, being signed in is enough. So for this variant, always put platform-admin in it.

The flow

This variant is not throttled. Throttling exists only for the public form.

With or without a tenant

What happens to the tenantKey in the payload is decided only by the flow’s setting tenant-assignment:

CIAS checks whether the named tenant exists during provisioning. If it is missing there, the registration ends in FAILED. See What happens on completion.

Next

• Invitation by the tenant administrator
• Where the tenant comes from