Control & Trust·production

IAM.Identity

Unified identity for users, tenants, roles and product sessions.

Landing Application

Key capabilities

  • SSO and user-session federation
  • Tenant membership and roles
  • Shared authentication context for IAM products

Step-by-step guides

Use cases

Start with the outcome: open a guide, prepare prerequisites, follow the steps and verify the success signals.

01 Connect corporate SSO to a tenantUsers sign in through the corporate IdP and receive only assigned roles.
Audience
IAM administrator
Outcome
Users sign in through the corporate IdP and receive only assigned roles.

Before you start

  • OIDC issuer metadata
  • Client id and secret
  • IAM product redirect URIs

Steps

  1. Create the identity providerAdd issuer, authorization/token endpoints, client id and secret reference.
  2. Map claimsMap subject, email, tenant/groups and required verified claims.
  3. Restrict redirect URIsAllow only HTTPS origins for the specific IAM applications.
  4. Test a userSign in and verify tenant membership and absence of extra roles.
Verify the result

The session contains the expected issuer, subject, tenant and role set.

If it does not work

Redirect loops usually indicate redirect URI, issuer or clock-skew mismatch.

02 Revoke a user's access across IAM productsNew tokens are denied and active sessions become invalid.
Audience
Tenant owner
Outcome
New tokens are denied and active sessions become invalid.

Before you start

  • Tenant owner role
  • User identifier
  • Revocation reason

Steps

  1. Open membershipFind the user inside the target tenant, not only in the global directory.
  2. Disable membershipProvide a reason and effective revocation time.
  3. End sessionsUse Sign out all sessions and revoke refresh tokens.
  4. Verify applicationsConfirm Core, Router and product apps respond with 401/403.
Verify the result

Audit contains membership disable and session revocation with one actor/reason.

If it does not work

If a session remains active, check token TTL and session-version enforcement in the app.

Application sections

Open detailed manual

Every application screen has a separate page with controls, safe example values, CLI/API alternatives and status-specific recovery steps.

Open detailed manual →

Role in the ecosystem

IAM.Identity forms the trusted context of the user and organization. Products get the subject identifier, tenant membership, roles and session restrictions, without creating incompatible authorization models for each surface.

Main scenario

sign-in → identity session → tenant selection → product session → scoped action

After authentication, the user selects an available tenant. Product checks session context and applies its own domain permissions. Absent tenant or the role is not replaced by a silent default scope.

Entities

  • User — user identity;
  • Tenant / organization — isolated organizational scope;
  • Membership — connection between user and tenant;
  • Role — set of allowed actions;
  • Session — time-limited login context;
  • Service credential—separate machine identity.

Integrations

Identity context is used by IAM.Core for tool discovery, IAM.Router for quotas and policy lookup, Marketplace for separation of user installations, and IAM.Bot - for tenant administration.

Safety

  • session tokens are not published in the URL and documentation;
  • changing the role or disable the user invalidates active access;
  • service credentials are not replaced by the user session;
  • tenant owner operations require separate verification;
  • audit associates an action with a subject and tenant without revealing the secret.

Operation

Check login/logout, session expiration and refresh, tenant change, disable/enable, invitations and downstream behavior after recall. Required for critical products separate regression for stale session and cross-tenant access.

Limit of responsibility

Identity confirms the subject and scope, but the domain decision remains with the product. For example, the right to enter the Marketplace does not mean the right to manage any hosted agent or change fleet-level settings.