Skip to main content
Installing Access Manager isn’t enough on its own. To start enforcing access, turn it on in each product. Set the Auth variables in the environment of any Lerian product or plugin where you want it active.
Enabling Access Manager only turns on authorization enforcement in a product or plugin. You manage access data separately through Access Manager. This includes users, groups, applications, providers, roles, and permissions.
Every protected product must enable enforcement and point to Auth. The variable names are not the same in every product: most products use PLUGIN_AUTH_ENABLED, Lerian SPI and Lerian SILOC use AUTH_ENABLED, and the address variable also changes. Use the variables named on the environment-variable page of the product you configure:
After you enable Access Manager, protected API requests must include an Authorization header with a valid Bearer access token.Without this header, protected requests will be rejected, even for endpoints that were previously accessible without authentication.Learn how to generate and use access tokens.

Where to update

Deployment lifecycle

Access Manager setup has two phases:
  • Bootstrap seeds a new environment with the base organization, roles, groups, applications, and permission sets required by the platform.
  • Operation starts after the environment is up. From that point on, manage access through the Identity APIs or Lerian Console.
Use the operational APIs for user access, group assignment, application credentials, providers, and MFA. Don’t change a running environment by editing bootstrap seed files.
Bootstrap applies its seed data only during initial environment setup. Changes to built-in resources, actions, roles, groups, applications, or permission sets in an existing environment must be delivered through controlled platform updates. Examples include migrations and an idempotent reconciler.