Airlock IAM as a client should be able to use username, roles, and context data item provided by the remote authorization server. This is achieved by configuring resource mappings to map remote resources into the local user.
To determine the user identity of the foreign authorization server it is required to configure at least one resource mapping that defines the username.
In addition to the username any other resources available may be mapped at login:
- User role resources will map their values into the authentee roles of the user logging in.
- User context data resources will map their values into the authentee context data.
In order to avoid ambiguity and to ensure a valid username, exactly one Remote Username Resource must be configured.
In OpenID Connect it is possible to use an ID Token resource (claim) instead of requesting a remote resource to be mapped.