Invitation by the tenant administrator

What this is about

A tenant administrator wants to bring a colleague into their tenant. For this there is the variant TENANT_ADMIN: they send the address and name, CIAS sends an email with a link, and when the colleague redeems the link, they are a member.

The flow

sequenceDiagram
    participant A as Admin (tenant nordbau)
    participant C as CIAS
    participant K as Keycloak
    participant M as Email
    participant B as User
    A->>C: POST /cias/tenant/registrations<br/>email, firstName, lastName
    C->>C: role tenant-admin? Tenant from the token: nordbau
    C->>K: create account disabled (only for a new address)
    C->>M: email with link
    C-->>A: 202
    M-->>B: email
    B->>C: redeems the link
    C->>K: enable, member of nordbau, member roles
    C->>M: welcome email

The variants

What the inviting person must provide

The flow’s configuration sets the fields. In cias-runtime only email is required; firstName and lastName are optional. What the inviting person leaves open, the link later shows as an open field, see Redeem an invitation.

How long the link is valid is also in the configuration (token-ttl). In cias-runtime it is 14 days.

Next

• Redeem an invitation
• The email is the account
• Initial roles as a rule set: which roles members get