Skip to content

Organization Admin Setup

Overview

This user story covers the setup and management of organization administrators on the REC Verifiable Credentialing Platform. Organization administrators are responsible for managing users, configuring organization settings, and overseeing credential issuance and verification activities.

User Stories

Initial Admin Account Creation

As a platform administrator,
I want to create an initial administrator account for a new organization,
So that the organization can begin managing their own users and settings.

Acceptance Criteria: - The system allows creating an admin user during organization registration - The system collects the following information for the admin user: - Full name - Email address - Phone number (optional) - Job title - The system validates the email domain matches the organization's domain - The system sends an invitation email to the admin with account activation instructions - The system enforces strong password requirements during account activation - The system requires multi-factor authentication setup during account activation - The system assigns the ORG_ADMIN role to the user - The system logs the admin account creation for audit purposes

Admin Self-Registration

As an organization representative,
I want to register as the initial administrator during organization registration,
So that I can manage our organization's presence on the platform.

Acceptance Criteria: - The system allows self-registration as an admin during organization registration - The system validates the email domain matches the organization's domain - The system requires email verification before activating the account - The system requires approval from a platform administrator before granting admin privileges - The system notifies the user when their admin account is approved - The system provides clear instructions for getting started after approval

Admin User Management

As an organization administrator,
I want to manage user accounts within my organization,
So that I can control who has access to the platform and what they can do.

Acceptance Criteria: - The system provides a user management interface for organization administrators - The system allows creating new user accounts with appropriate roles: - ORG_ADMIN (additional administrators) - ORG_USER (standard users) - ISSUER (users who can issue credentials) - RELYING_PARTY (users who can verify credentials) - CREDENTIAL_MANAGER (users who manage credential lifecycle) - The system allows editing existing user details - The system allows deactivating and reactivating user accounts - The system allows resetting user passwords - The system prevents organization admins from modifying platform admin accounts - The system logs all user management actions for audit purposes

Admin Role Assignment

As an organization administrator,
I want to assign appropriate roles to users in my organization,
So that they have the correct permissions for their job responsibilities.

Acceptance Criteria: - The system allows assigning one or more roles to each user - The system displays the permissions associated with each role - The system allows changing role assignments as needed - The system prevents removing the last administrator from an organization - The system applies role changes immediately - The system notifies users when their roles are changed - The system logs all role assignment changes for audit purposes

Technical Details

Admin User Schema

The admin user entity will extend the base user entity with: - organization_id (UUID, foreign key to organizations) - is_primary_admin (boolean) - admin_since (timestamp) - last_admin_activity (timestamp)

Role-Based Access Control

  • ORG_ADMIN role will have permissions to:
  • Manage organization settings
  • Manage users within the organization
  • View all organization activity
  • Issue and verify credentials
  • Configure credential templates
  • Other roles will have more limited permissions as appropriate

Security Considerations

  • Admin accounts must use multi-factor authentication
  • Admin password requirements must be stronger than regular users
  • Admin activity must be logged for audit purposes
  • Admin sessions should have shorter timeout periods
  • Failed login attempts to admin accounts should be monitored and alerted