Manage members
Members are users of Identity as a Service (IDaaS). Group membership, assigned roles, and user attributes determine which IDaaS features a user can access.
This section explains how to set up and manage users, attributes, roles, and groups. Access to user management depends on role and group assignment. Administrators can manage only the users who belong to the same groups.
Human identities and workload identities
IDaaS supports two types of identities:
- Human identities represent people who sign in interactively, such as employees or administrators.
- Workload identities are non-human identities that represent a service, application, or automated process rather than a person. Workload identities let your machines and services authenticate to IDaaS and call protected resources without a user being present, which supports machine-to-machine (M2M) scenarios.
Topics in this section
Users
8 items
Groups
A group in IDaaS is a set of users. You can add users to groups or remove users from groups that your role allows you to manage. If your role includes permission to Manage All Groups (see Create, assign, and manage roles), you can create as many groups needed to control which applications users can access.
Organizations
An organization is an entity in IDaaS to which users can be associated. An IDaaS user can belong to one or more organizations. When the user authenticates using SAML or OIDC, the authentication response indicates the organizations to which the user belongs. Organizations can then be returned from an OIDC and OAuth as claim values or a SAML application as attribute values, as follows:
User attributes
User attributes are the information fields stored in a User Profile. IDaaS supports two types of attributes:
Roles
Roles control what users can do in IDaaS. Each role defines which system entities a user can access and which actions they can perform on those entities. System entities represent different IDaaS management areas. For example, a role that includes the User Passkey/FIDO2 Token Management entity allows a user to view, add, edit, or remove Passkey/FIDO2 tokens, depending on the permissions assigned to the role.
Workload identities
A workload identity is a non-human identity associated with a service, application, or automated process. When you create a workload identity, IDaaS automatically provisions an associated OpenID Connect (OIDC) and OAuth server application for it. The workload uses this application's client credentials to obtain access tokens through the OAuth client credentials flow. You manage the workload identity and its OIDC application together from a single set of pages.