Registration & Enrollment

IAM implements a basic registration service that implements an administrator-vetted registration flow, where users apply for membership in an organization and administrators are asked to validate membership requests.

Requiring external authentication

Starting with version 1.6.0, IAM allows to request that users are authenticated from a trusted identity provider (SAML or OIDC) in order to apply for membership. It’s also possible to control how information in authentication tokens and assertions is mapped to IAM registration fields.

For example, see the following fragment that requires authentication with the CERN SSO and defines how information from identity tokens issued by CERN SSO is mapped to IAM membership information

iam:
  registration:
    require-external-authentication: true
    oidc-issuer: https://auth.cern.ch/auth/realms/cern
    authentication-type: oidc
    fields:
      name:
        read-only: true  # When false, allows user to override what comes from the authentication information
        external-auth-attribute: given_name
      surname:
        read-only: true
        external-auth-attribute: family_name
      email:
        read-only: false
        external-auth-attribute: email
      username:
        read-only: false
        external-auth-attribute: preferred_username

User editable fields

Starting with version 1.6.0, IAM allows to limit which fields of the user profile are editable by users.

The default, backward-compatible settings that allow users to edit all their profile fields are defined as follows:

iam:
  user-profile:
    editable-fields:
      - email
      - name
      - picture
      - surname

To prevent modifications to any of the fields remove the field name from editable-fields list.

External configuration can be managed by placing directives as shown above in a custom configuration file