Members and roles

The Members and roles screen lets you add the people of the tenant, give each one a role and a data clearance, change them and remove a membership. Portal path: /admin/members. It is used by the tenant administrators (tenant_admin); every member of the tenant can read the list.

What the screen shows

A Members table with Refresh and Invite member:

Column	Content
User	Subject of the person (OIDC sub or user id).
Display name	Name shown in the portal.
Email	Email address.
Role	Role of this membership: platform_admin, tenant_admin, security_officer, finops, developer, auditor, agent or viewer.
Clearance	Highest data classification the member may read: public, internal, confidential, restricted, secret.
Created	Date of the membership.

One line is one membership: a person with two roles has two lines. The list is paged. Empty state: No member, "Add a member and assign roles."

For a platform_admin, an Operator consoles block under the table gives the link Open the console to Keycloak (identities), or the reason why it is not configured.

Actions

Button or action	What it does	API call	Roles
Opening the screen, Refresh	Reads the memberships page by page.	GET /v1/members	Member of the tenant
Invite member then Create	Form User (required), Display name, Email, Role (required), Clearance, Project (suggested from the projects). The server creates the user when needed; the same user with the same role updates the clearance and the project, with another role adds a membership. Clearance internal when left empty.	POST /v1/members (suggestions: GET /v1/members, GET /v1/projects)	tenant_admin
Change roles	Dialog Role (required) and Clearance, then Change roles.	PATCH /v1/members/{id}	tenant_admin
Remove	Destructive confirmation with the impact, then removal of the membership.	DELETE /v1/members/{id} (impact: GET /v1/lineage/graph)	tenant_admin
Open the console (Keycloak)	Opens the identity console in a new tab.	none	platform_admin

Roles

From services/control-plane/src/eai/domains/tenancy/__init__.py: reading needs a principal inside a tenant (require_tenant); adding, changing and removing require tenant_admin (platform_admin always passes). Giving the platform_admin role is refused with forbidden to anyone but a platform_admin. The portal shows the buttons to every user; the server decides.

note

A membership created by a directory group is revoked when the group leaves the token of the user, unless an administrator changed it by hand afterwards: a membership edited on this screen becomes a manual one.

Typical tasks

Give a person access to the tenant

1. Open the form. Button Invite member. Expected result: the side form. If it fails: no button means the screen did not load; click Refresh.
2. Fill the identity and the role. User: the subject of the identity provider; Role: the role needed, for example developer; Clearance: internal or higher if the person reads confidential data. Then Create. Expected result: the toast Created and the new line. If it fails: forbidden when you are not tenant_admin or when you give platform_admin without being one.
3. Check the sign-in. Ask the person to sign in. Expected result: the screens of their role are reachable. If it fails: the subject typed differs from the sub of the token; fix User.

Change the role of a member

1. Open the action. Row menu > Change roles. Expected result: a dialog with the current role and clearance. If it fails: not_found at submit time means the membership was removed meanwhile.
2. Choose the new role and submit. Expected result: the toast Done and the line updated. If it fails: conflict (HTTP 409) when the person already holds that role in another line; remove one of the two lines.

Remove a membership

1. Open the action. Row menu > Remove, read the impact, confirm. Expected result: the line disappears. If it fails: forbidden when you are not tenant_admin.

Troubleshooting

Symptom	Cause	Fix
forbidden (HTTP 403) with required_roles: ["platform_admin"]	You give the platform_admin role without being one.	Ask a platform administrator.
forbidden (HTTP 403) on any change	Your role is not tenant_admin.	Ask a tenant administrator.
conflict (HTTP 409) on Change roles	The person already holds the target role.	Keep one line per role.
not_found (HTTP 404)	The membership or the project identifier does not exist.	Click Refresh; check the Project field.
tenant_required (HTTP 403)	The session does not act inside a tenant.	Sign in with an account of the tenant.
Operator consoles shows "Not configured"	No Keycloak console address is configured.	Set the named setting or install the service with the Navin Manager.

Related pages

• Directory groups
• API keys
• Service identities
• Tenants
• Security documentation