Centralised identities, secure authentication and access controlled through roles and policies.
Scattered accounts are a security problem
In an organisation that uses several applications, each with its own users, the same symptoms appear: accounts of people who left two years ago, rights accumulated from previous roles, reused passwords, and nobody who can fully answer the question “what can person X do today”.
Identity management answers the question at the source: one identity per person, one place where rights are granted and withdrawn, one place where you see what everyone has.
How access works in the platform
Rights are granted to roles, not to people. A role describes what someone can do in a component; the person receives the role. When someone changes post, the role changes and the rights follow — they do not stay behind, as happens when each right is granted individually.
Granularity goes down to the component. In the registry, for example, consulting, registering and cancelling are three separate rights, configurable on each register. Someone may have the right to register in the incoming register and only to consult the register of decisions.
The check is done on the server, at every request, starting from refusal: what is not explicitly allowed is refused. Withdrawing a right takes effect immediately, not at the next sign-in.
- one identity per person, one place of administration;
- rights on roles, which follow the change of post;
- granularity down to the component and the register;
- withdrawing a right takes effect immediately.
Integration with what you already have
If the organisation uses an identity directory, integration follows the usual protocols for federated authentication and for reading group membership. The platform’s roles can be aligned with the existing groups, so administration stays in one place.
The actual scope of the integration — what is synchronised, in which direction, how often — is set at implementation, after an inventory of your infrastructure.
Questions and answers
Does it integrate with Active Directory?
Integration with an identity directory is done through the usual federation protocols. The exact scope is set at implementation, depending on your infrastructure.
What happens when an employee leaves?
The identity is deactivated, and all rights that come from its roles end. The operation stays in the audit log.
Can we define our own roles?
Yes. Roles are defined after the organisation’s structure and procedures, not after a fixed model.
What is the difference from PAM?
IAM manages identities and ordinary access. PAM handles separately the accounts with elevated privileges, which need isolation and additional audit.