Administer identity and permissions
Learn how organizations, users, groups, and permission evidence govern access to knowledge.
OrgMemory separates sign-in identity, internal user state, product relationships, source-native permission evidence, and audit. Administrators can govern these layers, but cannot turn an observed email or group name into an implicit grant.
Administrative model
Authentication
Keycloak authenticates; an explicit issuer/subject binding selects one active internal actor.
Organization administration
OpenFGA can_manage_members gates every administration endpoint.
Source identities
Stable source-native users and groups are observed first, then mapped only through verified trust.
Permission evidence
Sealed ACL and group-membership generations preserve what a source actually reported.
Invite and bind a user
Create an invitation expectation for the user's organization, address, and initial local business role. Only one open invitation may exist for that address in the organization.
Ask the user to sign in through the configured identity provider. A verified address may select exactly one invitation, but never becomes the durable identity key.
Confirm that the user now reports a linked external identity. The durable binding is the provider's issuer and subject.
Zero eligible invitations or ambiguity across organizations provisions nothing. An existing linked identity always wins. There is no open registration.
User and role administration
The administration API lists internal users, activation, local role, whether a sign-in binding exists, and how many source principals resolve to the user. An administrator may change another user's activation or local role, but cannot self-edit and accidentally remove the organization's last viable administrator.
The local role is business/classification state. It is not a Keycloak role and not an OpenFGA relationship. Changing it cannot grant organization or Knowledge Space authority.
Correlate source identities
Source adapters report users and groups by stable, typed provider-native IDs. Email and display name may assist review but are mutable observations.
Inspect the observed source principal and the connection that reported it.
Confirm a mapping only when the source itself vouches for the identity or an administrator has recorded the connection-level trust decision.
Review the active sealed group-membership snapshot and generation. A complete replacement advances the head atomically.
Revoke a wrong mapping. Retrieval closes on the next request without rewriting source content.
Observation alone grants nothing. An unmapped user or incomplete group membership fails closed.
Explain effective access
Administration can ask whether one user has one permission on one supported resource and inspect the OpenFGA relationship expansion behind the answer. Enforcement continues to use canonical check ports; the explanation does not become a second policy engine.
A verdict may be allowed, denied, or unknown. Unknown preserves the distinction between an unavailable answer and an explicit refusal.
Audit expectations
Mapping, revocation, role, activation, invitation, source-credential, and trust changes append redacted events attributed to the acting administrator. Audit records identify the affected object and decision but do not retain credentials or raw search text.
Cập nhật lần cuối