See how Access Manager’s Auth, Identity, and product-level enforcement fit together to authenticate subjects and enforce permissions across products.
Access Manager is built from two services. Each protected Lerian product enforces access control at the route level through the Auth client; Identity provides the management. Together, they cover the three jobs of access control: managing access data, deciding access at runtime, and enforcing those decisions inside each product.
Auth is the runtime decision layer. It issues tokens, verifies MFA, returns user information, and answers permission checks.
Identity is the management layer. It stores users, groups, applications, communication providers, application-provider links, and MFA configuration.
Product-level enforcement is the runtime integration inside protected products. When a product enables its Auth client and configures an Auth address, it calls Auth before product business logic runs. It is not a third Access Manager service.
For example, Identity creates a user and assigns the user to a product group. Auth issues the access token and answers permission checks for that token. A product configured for enforcement applies those decisions on its protected routes before the request reaches the product handler.
Auth service
Runtime tokens, MFA verification, user information, permission decisions, and cache.
Identity service
Management of users, groups, applications, communication providers, and MFA configuration.
Product-level enforcement
Route-level checks inside protected Lerian products that call Auth before business logic when their Auth client is enabled and configured.
Auth, Identity, and product-level enforcement do not replace each other. Identity defines access data, Auth makes authentication and authorization decisions, and products with their route-level integration enabled enforce those decisions at runtime.
