Portal Tenant And User Administration

Purpose

This functional area manages the organizational structure of the platform and the people who can operate within it.

It defines who belongs to the platform, which tenant they work in, and what administrative scope they have.

Main Capabilities

• tenant creation and maintenance
• tenant activation and deactivation
• platform user creation and maintenance
• multi-tenant assignment for users
• role and administrative scope management using area-based roles
• per-user authentication mode control
• administrator-set password reset with optional forced change at next logon
• sign-in lockout clearance for accounts locked out by repeated failed authentication attempts

Tenant Management

Tenants are the core functional isolation boundary of the platform.

Administrators can:

• create tenants
• define tenant identity information
• activate or deactivate tenants
• inspect tenant records

Tenant-aware behavior across the platform depends on this configuration.

User Management

The Portal provides administrative user management for platform accounts.

Supported functions include:

• create users
• edit users
• inspect user records
• delete users when appropriate
• control authentication mode per user
• assign platform roles and scopes to users
• set a local password for a user and optionally require a password change at the next sign-in
• clear sign-in lockouts caused by repeated failed authentication attempts

This area is responsible for the lifecycle of users who can sign into the Portal.

Sign-In Lockout Management

When a user account is locked out due to repeated failed sign-in attempts, administrators can clear the lockout from the Users page without needing to reset the user's password.

The unlock action is available as an action button in the user list. Clicking the button opens a confirmation dialog that identifies the target user by username and requires explicit confirmation before the lockout is cleared. This prevents accidental execution from a misclick in a dense table.

Once confirmed, the lockout is removed immediately. The user can attempt sign-in again straight away.

Only users with MEMBERSHIP_MANAGE (or the global equivalent) can clear lockouts.

Authentication Mode

Each user account has an authentication mode that determines which sign-in methods are permitted for that account.

The supported values are:

• Local only — the user can only sign in with a local username and password. All external identity provider sign-in attempts are blocked.
• External only — the user can only sign in through a connected external identity provider such as Microsoft Entra ID or Keycloak. Local username and password sign-in is blocked.
• Local + External — the user can sign in using either a local password or an external identity provider.

The default for newly created accounts is Local only.

This setting is independent of whether external identity providers are configured. Setting a user to External only without an active provider link for that account will prevent them from signing in until a link is established.

Typical usage:

• Use Local only for service or bootstrap accounts that must never authenticate through an external directory.
• Use External only for corporate user accounts that are fully managed by an organizational IdP, eliminating the local-password bypass path.
• Use Local + External during IdP migration periods or for accounts that legitimately need both options.

User-To-Tenant Assignment

The Portal supports assigning users to one or more tenants so that access can be scoped correctly.

Functionally, this determines:

• which tenant context a user can administer
• whether a user operates globally or within specific tenant boundaries
• how tenant-aware access control behaves in the Portal

Each tenant assignment carries its own role set. This allows one user to have different responsibilities in different tenants, such as MEMBERSHIP_MANAGE in one tenant and GOVERNANCE_READ in another.

Role Model

The platform uses a three-tier role model: legacy global roles, global area roles, and tenant-scoped area roles.

Legacy Global Roles

Assigned without a specific tenant. Broad cross-tenant access. Prefer global area roles for new users to apply least-privilege.

Global Area Roles

Assigned without a specific tenant. Give the holder least-privilege access to a single area across all tenants. These fill the gap between SUPER_ADMIN and tenant-scoped roles for operators who need cross-tenant access to one specific area.

Global area role holders bypass per-tenant access enforcement within their area, matching the cross-tenant behavior of SUPER_ADMIN and GLOBAL_READONLY but limited to a single area.

Tenant-Scoped Area Roles

Assigned within the context of a specific tenant. Each area of the portal has its own Read and Manage role, enabling least-privilege delegation within a single tenant.

Legacy Compatibility Roles

The following coarse tenant-scoped roles are maintained for backward compatibility. Existing users with these roles continue to work without changes. New users should be assigned area-specific roles instead.

Security Role Restriction

The Security area is intentionally narrower than all others.

GLOBAL_READONLY and TENANT_READONLY do not grant read access to the Security area. Users must hold an explicit SECURITY_READ, SECURITY_MANAGE, GLOBAL_SECURITY_READ, GLOBAL_SECURITY_MANAGE, SUPER_ADMIN, or TENANT_ADMIN role to access security resources.

This prevents read-only portal users from inadvertently viewing sensitive configuration such as identity provider secrets, credential workflow details, and outbound rules.

Administrative Scope

Role assignment controls which combination of areas a user can access and at what level:

• Global scope — SUPER_ADMIN, GLOBAL_READONLY, or any GLOBAL_<AREA>_* role. These users can access resources across all tenants within their area(s).
• Tenant scope — all other roles are scoped to a specific tenant. Users with tenant-scoped roles only see and administer resources within their assigned tenant.

Non-super-admin users can only assign tenant-scoped roles to other users. All global roles (including global area roles) can only be assigned by a SUPER_ADMIN.

Operational Importance

Tenant and user administration provides the human governance foundation of the platform.

Without it, the platform could not:

• separate customer or organizational boundaries
• control who can configure mappings and tools
• restrict administrative capabilities to the correct audience
• enable fine-grained operational delegation through area-specific roles