One business record per person
Alongside the account in the identity provider, CIAS keeps its own user record for every person: email address, display name, status and home tenant. Password and second factor stay where they belong – in the identity provider. CIAS never sees them.
The email address is the account. There is exactly one account per address, and it can be a member of any number of tenants. Because the business data lives in CIAS, changing the identity provider does not mean migrating your user data.
Four states instead of “on” or “off”
An identity provider usually only distinguishes enabled and disabled accounts. CIAS distinguishes four states, because “suspended” and “closed” mean different things in business terms:
- Pending – the person exists but has not been activated yet.
- Active – only in this state can they sign in.
- Suspended – temporary and reversible at any time; roles and groups are kept.
- Closed – final. The account is disabled, nothing is deleted, the history remains.
Clear responsibilities in administration
Suspending, closing, renaming and changing the home tenant are reserved for platform administrators. Suspending and closing require a reason, which goes into the audit. Tenant administrators invite new people into their own tenant but do not manage existing accounts.
Accounts that already existed in the identity provider before CIAS are imported as users. The import only adds and leaves known accounts untouched – so it can be repeated as often as needed.
Groups bundle roles
Instead of giving every new support colleague ten roles one by one, you create a group once and add them as a member. A group carries roles of several modules at the same time and applies platform-wide. Being a member means receiving the roles – not seeing other members’ data. Which data someone sees is decided by the tenant.
A group can be a default group: every new account becomes a member automatically. By design this only applies going forward. A single checkbox does not change the rights of every existing person at once. Groups and their members are managed by platform administrators only.
On failure, fewer rights – never more
Groups and roles live in CIAS and as a copy in the identity provider. CIAS writes in a fixed order: when revoking, the identity provider comes first; when granting, it comes last. If something fails in between, the person has fewer rights, never more. A reconciliation at start-up or on request brings the copy back in line – and also removes anything that was changed on a managed group behind CIAS’s back.