Groups and the attribute schema

Applies to: SimpleTwo 0.9.x, identity 0.2 · Verified: 24.09.2026

Groups, address books, mail aliases and the attribute schema live in a server role of their own, identity — its own Postgres database, its own host. The platform console shows one Identity card (Settings → Identity): the role's state and two tables, groups and attributes. Everything saved there goes through the coordinator: the right to change is decided where administrators' roles are, and identity's refusal is shown in identity's own words.

When the card is empty

"no identity host yet" — no host is enrolled for the role. Enrolment is the calendar's: Servers → role identity, a private address is required (its leg toward Postgres), a public name is optional. The database simpletwo_id is created by the postgres role automatically; once the host exists, redeploy postgres once so the pg_hba rule narrows to the new host's address.

Kinds of groups

kind	who owns the membership	for
synced	the identity provider (ADFS/AD) — written at every sign-in, read-only here	roles, gateways, directory scope
unit	a rule over attributes: company, department, site	@dept, a team's calendar, an audience for rules
managed	a list from the console, or a rule	on call, reviewers, a project's people
resource	the rule entity: resource	rooms in the booking picker
published	a list; visibility federated laid down, switched on with the federation phase	"our contacts at X"
personal	the person; visible to them alone	favourites, "my team"
system	the platform; not deletable	role groups

The kind cannot change after creation: a group of another kind is another group.

A dynamic group's rule

rule is a map of key to value; every pair must match. The keys are what an account really carries: the schema's attributes plus user, display_name, is_guest, entity. entity takes person, service, resource, a comma-separated list, !resource ("everybody except the rooms") or any.

A key nothing carries is refused at save, naming the key and listing the ones that exist. Not pedantry: on 08.09.2026 a welcome rule was narrowed on is_room: false — no such variable existed, the rule stopped matching anybody, and for ten days it silently greeted nobody while the console showed it enabled.

Who may address a group

writers — who may mention the group, write to its address, ring it: user:<name>, role:<name>, group:<id>. Empty means anybody who can see the group. There is no ceiling on reach: @sales in a company of four thousand is four thousand notifications, and the control is who may, not how many it hits. owners may edit the membership, writers and join without being administrators. address makes the group a distribution list — of any kind, dynamic included.

The attribute schema

Every attribute is one definition: kind (text, number, date, birthday, phone, address, url, choice, multichoice, user, bool), source — exactly one writer (self, admin, claim, ldap, hrms, scim), visibility (everyone, unit, managers, admins, self), searchable, required, the values of a choice, pattern. The LDAP and SCIM names are filled in with our own prefix (x-simpletwo-…, …:extension:simpletwo:2.0:User:…) unless you name standard ones.

What the schema refuses, so that it stays a schema:

• a kind change — widening text to choice would silently invalidate every stored value; retire the definition and define a new key;
• removing a choice a value may carry;
• deleting a definition — only Retire: values stay readable to administrators, the key stays reserved, Restore brings it back;
• computed attributes ("full name from two fields") — a stored derivation goes stale with nothing saying so.

A definition added here is a valid key in group rules and automations the same moment.

Address books

Personal books are stored on the server for the sake of a second device, but they are not shown in the console and cannot be read through the coordinator — there is no route to another person's book for anybody. The organisation's book (owner = org) is shared: external partners, suppliers, hotlines; administrators maintain it.

What the state line says

v0.2.0 · http://10.40.0.7:8086 · https://id.example.com — the role's version, the private address the coordinator dials, and the public name if there is one. unreachable — the host is enrolled but does not answer: read the role's log on the host (journalctl -u simpletwo-identity); it is usually an ID_DB_DSN that pg_hba does not admit.