A colleague is invited

What this is about

Anna administers the tenant nordbau. She wants to bring Bea in. CIAS has no separate mechanism for that: an invitation is an ordinary registration, only in the variant TENANT_ADMIN – the administrator starts it, and the invited person finishes it.

Who may invite

The tenant of the invitation is the caller’s tenant. A tenantKey in the payload is discarded without being checked. That way nobody can invite into somebody else’s tenant.

The flow

sequenceDiagram
    participant A as Anna (tenant-admin, nordbau)
    participant C as CIAS
    participant K as Keycloak
    participant M as Email
    participant B as Bea
    A->>C: POST /cias/tenant/registrations<br/>email, firstName, lastName
    C->>C: check the role, tenant from the token: nordbau
    C->>C: is there already an account for that address?
    C->>K: only if not: create the account disabled
    C->>M: mail with a one-time link to /registration/verify
    C-->>A: 202 accepted
    M-->>B: mail
    B->>C: opens the link and redeems it
    C->>K: membership in nordbau, attributes, member roles
    C->>C: user record, registration COMPLETED
    C->>M: welcome mail
    B->>K: signs in

Anna does not learn from the answer whether Bea already has an account: both cases answer 202 accepted. Only the mail differs, and only Bea sees it.

The two cases

What Bea does from the mail

In both cases the link in the mail points at the same page: /registration/verify?token=…. That page can do two things:

Redeeming takes only the token. Details Anna did not provide stay empty; the display name in the user record is built from first and last name and otherwise falls back to the address.

How long the link is valid is set by the flow’s configuration (token-ttl). In cias-runtime it is 14 days.

What Bea may see afterwards

On redeeming, Bea gets the roles of the situation TENANT_MEMBER – not those of a founder. An invitation must not hand out tenant administration.

More on that: Effective roles, Initial roles as a rule set, The three levels at a glance.

If Anna wants to give Bea more than the initial roles, she grants a role through POST /cias/admin/role-assignments. That works only if the role is a tenant role, is delegated to a role Anna holds, is granted in her own tenant, and Anna holds it herself. See Grant a role.

When the invitation does not work

Watch out

Next

• Invitation by the tenant administrator
• Redeem an invitation
• One person in two tenants
• A new customer is set up