0

I am looking at IAM for a SaaS application. The application will have client organisations accessing it and each organisation will want to manage their own users, permissions and roles. Of course only a subset of the full set of system permissions will be managed by the clients and there will also be administrator access.

Is this supported by AD FS natively or with add ons? How would someone go about doing this? Is there another IAM solution that would support this better?

Improve this question

2 Answers 2

Reset to default
2

What you are looking for is an Identity Manager. There's a few around e.g. OpenIDM.

Essentially Identity Managers provision users, manage roles, handle password issues etc.

STS like ADFS allow authentication against those users.

ADFS sits on top of AD. You could provision directly against AD using ADUC, via LDAP, via C# libraries etc. but these are all outside the remit of ADFS.

Improve this answer
-1

No, nor should you need to. They should federate with your instance and manage their own users.

Improve this answer
2
  • If these were large enterprises and there were only a few of them I would agree. These are small businesses with no plans to set up IdM for their organisations - we need to provide it for them.
    – Peter Kelley
    May 22, 2015 at 0:48
  • ADFS is not an IDM it's a token service that provides secure authentication to applications. an IAM solution could include ADFS but is more likely to include systems like Azure AD or OKTA which allows access to an entire IAM solution. In no case would I see any benefit (or profit) for becoming the outsourcing identity management solution(unless you have a building full of lawyers on retainer) as the liability potential is huge from an identity perspective. This would be like the old managed firewall service providers. They are still around but their contracts make them liable for nothing.
    – Jim B
    May 22, 2015 at 15:47

Not the answer you're looking for? Browse other questions tagged .