0

I am looking at IAM for a SaaS application. The application will have client organisations accessing it and each organisation will want to manage their own users, permissions and roles. Of course only a subset of the full set of system permissions will be managed by the clients and there will also be administrator access.

Is this supported by AD FS natively or with add ons? How would someone go about doing this? Is there another IAM solution that would support this better?

Peter Kelley
  • 101
  • 3

2 Answers2

2

What you are looking for is an Identity Manager. There's a few around e.g. OpenIDM.

Essentially Identity Managers provision users, manage roles, handle password issues etc.

STS like ADFS allow authentication against those users.

ADFS sits on top of AD. You could provision directly against AD using ADUC, via LDAP, via C# libraries etc. but these are all outside the remit of ADFS.

rbrayb
  • 1,108
  • 1
  • 12
  • 20
-1

No, nor should you need to. They should federate with your instance and manage their own users.

Jim B
  • 24,081
  • 4
  • 36
  • 60
  • If these were large enterprises and there were only a few of them I would agree. These are small businesses with no plans to set up IdM for their organisations - we need to provide it for them. – Peter Kelley May 22 '15 at 00:48
  • ADFS is not an IDM it's a token service that provides secure authentication to applications. an IAM solution could include ADFS but is more likely to include systems like Azure AD or OKTA which allows access to an entire IAM solution. In no case would I see any benefit (or profit) for becoming the outsourcing identity management solution(unless you have a building full of lawyers on retainer) as the liability potential is huge from an identity perspective. This would be like the old managed firewall service providers. They are still around but their contracts make them liable for nothing. – Jim B May 22 '15 at 15:47