OpenID Connect Protocol

Editing your IAM configuration

With the exception of the IAM ID (also called the display name), any of these settings can be changed after an IAM is configured. To edit IAM settings, click the dropdown arrow next to the IAM listed in the identity management section on the app settings page and then make your changes.

1. Navigate to the Immuta App Settings page.

2. Scroll to the Identity Management section and click Add IAM.

3. Complete the Display Name field and select OpenID from the Identity Provider Type dropdown.

4. Take note of the ID and copy the SSO Callback URL to use as the ACS URL in your identity provider.

5. Adjust Default Permissions granted to users by selecting from the list in this dropdown menu.

6. Enter the Client ID and Client Secret from your identity provider.

7. Enter the URL of your identity provider's discovery endpoint in the Discover URL field. If you do not provide this URL, you will have to complete the manual endpoint specification fields (authorization endpoint, issuer, token endpoint, etc.).

8. Opt to add additional Scopes.

9. Opt to Enable SCIM support for OpenID by clicking the checkbox, which will generate a SCIM API Key. Validate that the usernames in your IAM match those in your data platform (Snowflake, Databricks, etc.). If they are incorrect in the IAM or the casing doesn't match, fix the data platform username in the identity provider before configuring SCIM in Immuta.

10. In the Profile Schema section, map attributes in OpenID to automatically fill in a user's Immuta profile. Note: Fields that you specify in this schema will not be editable by users within Immuta.

11. Opt to Allow Identity Provider Initiated Single Sign On to use the IDP-Initiated SSO feature by selecting the checkbox.

12. Opt to Migrate Users from another IAM by selecting the checkbox.

13. Click Test Connection and Test User Login.

14. Save your configuration.