B2B IAM

iWelcome offers multi-level user management functionality that can be used to add users and groups, assign users to groups and to push the workload and accountability of specific actions to other users.

Delegation of user management is supported on several levels, where at every level users can be assigned the role of delegated admins, allowing them to cascade roles to identities in scope.

By using a decentralised access management system, our customers leverage the platform's multi-level capability of managing identities.

Among others, the following scenarios are supported:

• User registration by delegated admin via a simple web-portal for (temporary) accounts;
• Administration (e.g. disable, delete, etc.) by delegated admin of temporary accounts;
• Delegated users/Guests can set and activate their own password via the self-service portal;
• Delegated users/Guests can reset or change their password via the self-service portal in case the password has been lost.

Client benefits

• Delegated users can (re)set/activate/change passwords;
• Available via customer-branded UI or RESTful API.

Access to information is governed by a combination of roles and role types, system rules and flexible structures.

Within iWelcome’s B2B IAM, roles are collections of permissions that control what data and applications an identity can access and what actions it can perform. These can be configured according to the organisation’s needs for users and applications.

The automation dimension of the platform is given by rules, that can be used to instruct the system to automatically assign pre-defined roles to all entities that follow the desired criteria, at a predefined periodicity.

We use flexible structures such as schemas, collections and structures as a logical means of organising data. By using a combination of static and adaptive structures that can be defined on a single level or can be nested on several levels, we provide a more granular control over what identities can access and how.

Client benefits

• Time-based account creation
• Invitation-based account creation
• Automation rules
• Approval workflow for application access
• Mass updates
• Customisation and configuration

Provisioning refers to the creation, maintenance and deactivation of user objects and user attributes over multiple systems and applications allowing these to interact with business logic.

The iWelcome platform provisions and de-provisions’ user accounts and attributes from multiple source systems (e.g. CRM, HR or any other identity stores like Active Directory, Windows Azure Active Directory, Identity Management Systems, and/or Master Data Management) and/or LDAP directories to business applications (relying parties). Provisioning of groups can be arranged via both push and pull mechanisms.

Client benefits

• Automated & efficient provisioning processes;
• Group provisioning on pull- and push basis;
• Supports open source frameworks as ConnID;
• Standard connectors or API- and SCIM-based.