Before you start
To manage partners, a user needs the
partners permissions of plugin-identity: get to see Partners in Settings, post to create a partner, patch to change one and delete to delete one. Managing its applications needs the applications permissions get, post and delete. The plugin-identity-editor-role role holds all of them.
Creating a partner, changing its permissions or scope, and creating its applications need Access Manager 3.11.0 or later. With an earlier version, the Console shows “Requires Access Manager 3.11.0 or later” in place of those controls.
Collect this information before you start:
- The products the partner needs, and what it may do in each one.
- The identifiers of the items the partner may reach, for each dimension you restrict. Each product that offers restrictions needs at least one. Copy them from the product’s own API or Console. The Console does not check that they exist.
- What each product’s restrictions reach: see Partners in Midaz and Partners in Pix JD.
- The network addresses the partner calls from, if you want to restrict them.
- The start and end dates of its access, if it has a time limit.
Open the Partners page
1
Open Settings
Click the gear icon () in the top navigation bar.
2
Select Partners
Select Partners. The subtitle reads “Give each customer its own credentials and limit what it can reach.”
Create a partner
Click New partner. The New partner panel opens, with five steps: Details, Products, Scope, Permissions, and Review. The Next button opens only when the current step is complete. The Back button keeps what you entered. If you close the panel before you save, the Console asks “Discard this new partner?”. Nothing is created until you save.
1
Details
Type the partner’s Name. It must be unique in your tenant.Under Validity window, fill in Valid from and Valid until if the access has a time limit. Leave Valid from empty to start now. Leave Valid until empty so it never expires. After the partner’s Valid until date, Access Manager refuses its requests, also with a token it already holds, and refuses new tokens.Under Where it calls from, choose one option:
- Use your organization’s IP list: the partner uses your tenant’s IP allowlist.
- Give it its own list: type each IP address or CIDR range and an optional Description. Click Add IP for each new line.
2
Products
Choose the products the partner can use. The list shows only what your tenant can give.A product that does not accept partners is unavailable, with one of these messages:
- “This product isn’t ready for partners yet.” The product has not published its scope catalog.
- “This product hasn’t enabled partner access yet.” The product’s scope catalog does not accept partners.
3
Scope
Say where the partner can act on each product. A restriction that the product requires is already open, with (Required) after its name.To add a restriction, check Restrict by followed by the name of the restriction. Type one identifier, or several identifiers separated by commas.Give the partner at least one restriction with an ID on each product that offers restrictions.
4
Permissions
Check the resources and the actions the partner can use on each product. To give a different set of actions on other resources, click Add another line on followed by the product name.The Console offers only what your tenant can give. It shows a reason next to each entry that it cannot save:
- Not allowed: the product’s editor role in your tenant does not hold this permission.
- Outside the scope: the write acts at a level wider than the partner’s scope.
- Granted twice: another line already grants the same action on the same resource.
5
Review
Read the summary under “Check what this partner can and can’t do”. The Only inside part lists the restrictions. The It can part lists the actions on each resource. The It can’t part lists what stays outside.Click Save. The Console creates the partner with no applications and opens its Overview tab.
Create the partner’s applications
A partner calls a product with an application that belongs to it. Create one application per product.
1
Open the Applications tab
In the partner list, click the partner. Select the Applications tab.
2
Create the application
Click New Application. In the New application side sheet, choose the Product. The list shows only the products that the partner has permissions on. Fill in Description and click Create application.
3
Save the credentials
The dialog “Save the credentials” shows the Client ID and the Client secret. The Console shows the client secret only when you create the application. Store it then. Click I’ve saved them to close the dialog.
Change a partner
Open the partner from the list. The detail page has five tabs:
Saving on Permissions or Scope replaces the permissions and the scope together.
Suspend or reactivate a partner
On the Overview tab, click Suspend and confirm. This deletes nothing. To end the suspension, click Reactivate and confirm. Suspending a partner in Access Manager stops its access, including the tokens it already holds. Reactivating the partner inside its validity window restores access with the same credentials.
Delete a partner
You can delete only a partner without applications.
1
Delete its applications
On the Applications tab, delete each application of the partner. Deleting an application stops its tokens from working.
2
Delete the partner
On the Overview tab, under Delete partner, click Delete and confirm with Yes, delete it. Access Manager also deletes its permissions, scope, and IP list. You cannot undo this.
Partners that use your tenant’s IP list
When some partners have no IP list of their own, Settings → Security shows a notice on the IP allowlist tab. The notice says how many partners use your tenant’s list, and its button lists them.