Identity & Access Management (IAM)
More than ever, critical data and processes are the target of hostile activity. The IAM protects the system from unauthorized access.
Use Case
Identity and Access Management (IAM) serves as the central permission management system for MCCS. IAM addresses both authentication (who can access the system) and authorization (what actions are permitted). Additionally, IAM enables the business organization to develop flexible and constantly evolving authorization concepts that account for the organization's processes and roles.
Benefit
The IAM enables product teams to define domain specific permission models while relying on a shared service for permission evaluation, enforcement, and governance.
IAM allows product teams to define domain-specific permission models while relying on a shared service for permission evaluation, enforcement, and governance.
An audit trail for IAM activities within the GrAS Logbook module ensures governance and legal compliance.
As new modules can be onboarded seamlessly and permissions added to existing and new journeys, IAM reinforces the modular approach of the platform.
The ability to integrate with the organization's existing Single Sign-on (SSO) services ensures a smooth and efficient access management flow.
Get in touch
Did you like what you saw? Reach out to discuss, cooperate and work with us.
The technology behind it
The Platform Module provides centralized identity and authorization capabilities based on a relationship-based access control (ReBAC) approach implemented through the openFGA Service. Keycloak is utilized to authenticate users using OAuth/Single Sign-on.
How does it work
Via the user interface, all modeled permissions and relationships can be managed and visualized. The permission model for each module provides the foundation for the individual permission settings managed from organizational groupings and process-oriented journeys to the single user or system. Access is subsequently validated by IAM's capabilities to determine whether the requester can be authenticated and possesses the necessary authorization for the requested action.
