Airlock IAM as a client, should be able to use username, roles, and context data items provided by the remote authorization server. This is achieved by configuring resource mappings to map remote resources to the local user.
To determine the user identity of the foreign authorization server, it is required to configure at least one resource mapping that defines the username.
- In addition to the username, any other resources available may be mapped at login:
- User role resources will map their values into the authentee roles of the user logging in.
- User context data resources will map their values into the authentee context data.
In order to avoid ambiguity and to ensure a valid username, exactly one Remote Username Resource must be configured.
In OpenID Connect, it is possible to use an ID Token resource (claim) instead of requesting a remote resource to be mapped.