Tenant users

A tenant user is a user who belongs to a tenant in CSTAR.

CSTAR stores tenant membership separately from the user's identity provider account. A user may authenticate through a supported BC Government identity system, but they still need to be added to a tenant before CSTAR can manage tenant access for them.

Adding users to a tenant

A user must be added to a tenant before they can be added to groups or receive connected-service roles through those groups.

CSTAR roles for tenant users

Tenant users can have CSTAR roles such as tenant owner, user admin, or service user.

These roles control what the user can do in CSTAR. They do not define what the user can do inside a connected service.

Groups and service roles

Tenant users can be added to groups. Connected-service roles are assigned to groups, not directly to individual users.

Removing users

When a user no longer needs access to a tenant, they can be removed from the tenant.

Removing a user also removes their active access through tenant groups and role assignments.