Audience: System Administrators
Content Summary: Any number of identity managers can be configured and enabled for an instance of Immuta. Each identity manager has a specific set of configurations that enables it to communicate with the IAM system and map the users, permissions, groups, and authorizations into Immuta.
Identity managers are used with Immuta to provide authentication and fine-grained user entitlement.
The Immuta IAM can be used as a complete solution for authentication and authorization. Group and attribute values within the Immuta IAM can be used to broker access to projects and data sources. They can also be used to drive policies.
The Immuta IAM is enabled by default, so there are no additional configuration options needed to support this mode.
External identity managers configured in Immuta allow users to authenticate using an existing identity management system and can optionally be used to synchronize user groups and authorizations into Immuta. Each identity manager configured in Immuta is assigned a unique identifier, referred to as the IAM ID, and all users, groups, and authorizations are associated with exactly one IAM ID.
Identity Manager Options and Configuration
Identity managers can be added from the App Settings page. The following section describes some of the most commonly used features that can be configured for an identity manager.
Each identity manager supports the configuration of default permissions. This configuration setting controls what permissions each user who logs in receives by default. These permissions are applied the first time each user logs in, and any changes to the default permissions will only apply to new users.
In the case where the default permissions are empty, new users will receive no special permissions in Immuta and an administrator will need to grant them any permissions that they need.
Each identity manager configured has a mapping of attributes from the source system into attributes on the user profile in Immuta.
This example is the profile schema mapping for an LDAP/Active Directory IAM.
Profile schema attributes provide general purpose user information and cannot be used as entitlements for policies.
Identity managers that support group synchronization will have a group schema configuration option. This defines how group attributes are mapped in Immuta.
This example is the group schema mapping for an LDAP/Active Directory IAM.
External Groups and Authorizations Endpoint
If desired, an IAM system can be used for authentication and combined with an external REST endpoint to retrieve user groups and authorizations. This option provides flexibility in exactly how groups and authorizations are associated with users in Immuta.
Custom IAM Integrations
Immuta's IAM connections are built with a pluggable NodeJS architecture. This architecture allows rapid development of a custom IAM integration to suit your specific needs.
If you plan to implement a custom IAM integration, contact your Immuta support professional for required source code access, full API documentation, and implementation guidance.