Overview
Identity Management provides all the necessary tools to manage consumers of clients that will access API Proxies in the Apinizer platform, create access control lists (ACL), perform contract and protocol management, manage organizations and IP groups, configure identity providers, and generate access reports.
Consumer access permission alone is not sufficient for API proxy access. For the settings in the consumer and access permission to be valid, one of the authentication policies must be added on the API Proxy and the Security Manager option must be selected as the authentication method in this policy.
Module Core Components
The Identity Management module provides centralized management of consumers and access control lists of clients that will access API Proxies. With this module:
- Client consumers and access permissions are managed
- Contract and protocol management is performed
- Organizations and IP groups are created
- Identity providers are configured
- Access reports are generated
Module Components
The Identity Management module is managed through the following pages:
Creating, managing consumers of clients that will access API Proxies and access control settings.
Creating and editing API Portal applications from the Portal menu, and managing their metadata.
Contract/protocol management with clients, API Proxy and consumer association.
Managing API Proxy and API Proxy Group-based access permissions, expiration and environment access restrictions from a single screen.
Managing access permissions of consumers of clients that will access API Proxies and API Proxy-based access control.
Keeping organization information that consumers are linked to, searching and grouping consumers.
Defining IP groups to manage a group of IP addresses together. Used in Allowed IP List and Blocked IP List policies.
Authorization and role definition after identity verification in API Proxies.
Creating and querying access control list reports based on API Proxy or organization/consumer.
Reusable API request count and AI token budget limits, deployed to the gateways and applied to organizations, consumers, applications and API clients; the Administration entry lists every project's plans together.
Monitoring consumer, plan and AI token and cost quota consumption from a single screen, and defining automatic alerts on threshold breaches.
Legal holds that block deletion, and erasure, correction, retention and crypto-shred purges run through a four-eyes approval workflow.
The retired Rate Limit Control List, kept as a read-only screen; its limits were migrated to limit plans.
Response field names, scope validation behavior and revocation strictness of the OAuth2 / JWT token endpoint (system administrators).
Identity Providers
Identity providers specify the user pool to be given to clients. These predefined identity providers are used when creating authentication policies.
Identity provider configuration for user verification via API.
Identity provider configuration for user verification via database.
Identity provider configuration for user verification via LDAP/Active Directory.
Identity provider configuration for token-based user verification via OIDC/OAuth2, with optional Keycloak user synchronization.
Scheduled synchronization of users from LDAP, Database, API, and OIDC identity providers into consumers.