Main IAM features
User creation and 2FA authentication
An administrator or an authorized user records the surname, first name and email address of a new user. The latter receives a link by email to activate their account, which allows them to set their password and add their smartphone as a second authentication factor using a QR code. The user authenticates with their email address and their password as the first authentication factor.
For the second authentication factor, an OTP (One-Time Password) token, in the form of a verification code, must be generated on the declared phone. As with every user management operation (creation, display, modification, deletion), you can use the Console or the API.
Link to the API Documentation.
Service account creation
For a service account, there is no second-factor check for the connection. The response to the creation request contains the access token to be used to call the services.
Connection journeys
Connection to the information system is performed by following the OpenID Connect (OIDC) authentication protocol, which uses the underlying OAuth 2.0 protocol. At the end of the identification and authentication processes, the user obtains an access token that they must present on each access to a resource.
For a user account
A user connection is performed in two stages, via an authentication page and the TOTP (Time-based One-Time Password). At the end of the checks by the identity server, an access token is returned to the user.
For a service account
The connection scheme is simpler because it does not go through two-factor authentication with a web form. The service presents its account identifier and the secret key to the identity server which, after checking, delivers an access token to it.
Blocking and unblocking a user account
After three unsuccessful connection attempts, the user account is automatically blocked. The user can no longer connect to the system. To reactivate an account:
- assistance by an administrator or account manager: an administrator or an account manager can intervene by generating a reactivation link to send to the user's email address. They can also directly update the state of the user account by switching it from "Inactive" to "Active".
Deleting an account and its permissions
The account deletion transaction permanently removes the account from the system. Therefore, for traceability and audit reasons, it is recommended to perform this operation in two stages:
- make the account inactive and delete its permissions;
- proceed with the deletion of the account.
The access token
After being identified and authenticated, the user or the service account receives an access token valid for a limited time. The Console presents this token to each resource it accesses. The service account does the same in the header of the request to the API.