Hi, everyone, and welcome back.
Now, in today's video, we are going to discuss about the IAM identity center.
Now at a high level overview iam Identity center which is a successor to the single sign on.
It allows the centralized access to multiple set of accounts and the applications that are running within
the organizations.
Now, this can also be seen in this specific diagram where you have a single IAM identity center and
from here you can go ahead and log in to multiple set of applications, including the accounts that
are part of your organization.
Now one of the benefit again here is that you do not really have to maintain multiple set of access.
For example, in a traditional organization which does not have a single sign on, you will see that
a user has a username and password for application like Jenkins, separate username and password for
a separate username and password for HR management system and so on.
So instead of having a separate user and password for each application in your organization, you have
a single set of identity and from here you can log in to all the applications in your organization.
And this is the reason why it is more of a single sign on based approach.
So let's also look into the basic steps.
So what user have to do?
They have to log in to the access portal associated with the identity center.
Once the user logs in, the user will be presented with all the accounts and the applications that they
have access to.
And from here the user can click on the account and they will automatically be logged in.
Great.
So before we proceed further, let's go ahead and have a quick demo to understand this in a better terms.
Now, currently I am in the IAM identity console and within here you see that we have a specific access
portal URL.
So this is the central URL that the user needs to log into.
And from here they can access all the accounts and applications.
So let's quickly open this up.
And from the incognito mode, let's add this specific URL.
So this is how the access portal looks like.
So let me add a user that I've already configured and I'll add a password once.
Then you can click on sign in.
Now, at this stage, you'll see that this user has access to two accounts.
Now, it does not always mean that account access will be provided.
The access of other applications can also be included.
So if I click here, you will see that two accounts access is available.
Now, if Alice wants to log into the sandbox account, all that needs to be done is you'll have to click
here.
And you have two options management console and CLA.
So let's open up the management console.
And you see, Alice has successfully logged in here.
Now, let's close this.
Now, let's say Alice needs access to the other account.
All Alice needs to do, just click on the account on the management console.
And Alice is logged into the second account as well.
Great.
So I hope with this at a high level overview, you understood how the single sign on experience can
be achieved using the IM identity centre.
Now, at this stage we had just taken an example of a.
However, you can also configure various other applications in case if you have.
So let's also quickly look into it now from the identity Centre.
If you look into the applications tab here, let's quickly add the application.
Now there are multiple pre integrated applications that are available and if you look into the list,
the list is quite large.
So all of these applications you can easily integrate with the identity centre, it includes GitHub
and various others.
If you search for Jenkins, Jenkins is also as part of pre integrated.
You also have option for adding a custom application in case if you do not see it in pre integrated,
you can also add a custom application here.
Great.
So I hope with this you understood the basic steps on how the user can centrally access multiple set
of accounts from a central console.
Now one of the questions that comes here is where is this user Alice stored?
Is it stored as part of the IAM?
So is this an IM user or this is a user specific to the identity center?
Let's go ahead and look into it.
Now, if you look into the overall workflow, you have the identity center here and this identity center
can fetch the user identities from multiple set of entities.
It can be Microsoft Active Directory.
This is also one of the common things that you will see in a lot of organization or identity center
also has its own identity store where you can store the username and password, and this username and
password can connect to the access portal from which, depending upon the permission, they will be
able to connect to the supported resources.
So in fact, let me also quickly show you this now within the identity center, if you look into the
users on the left at this stage, you see that we have one user called Alice that is configured.
Now note that this is different from the IAM user.
This is not an IAM user, this is a user that is part of the identity center.
You can also go ahead and easily add a user.
You also have a provision of groups that you can integrate apart from that, for the organizations that
already have users that are configured as part of Microsoft Active Directory for an example, that is
also something that you can easily integrate.
So when you look into the identity source.
Let me quickly show you.
So if I change the identity source, first option here you have the identity center directory.
So this is something that we have just seen.
You also have the option of the Active Directory and you also have option for external identity provider,
which you can integrate here.
So it is not necessary that you have to create all the users at the identity center level.
Now, one more thing that I also wanted to show you is that the overall single sign on experience works
pretty well with the CLA as well.
So instead of configuring the access and secret keys within the credentials file, etc., the single
sign on users can directly authenticate and the keys will automatically be configured as part of your
environment.
In fact, let me also quickly show you this now from the ClA, if I'll quickly do a double configure.
So here's it will ask me for the session name.
Let me just call it a test.
It will ask for the start URL.
So this is nothing but the URL that we had entered in the browser for the user to be able to log in.
Now let's quickly look into it, so let's copy this URL.
I'll add here the region.
I'll just say us East one.
You see, there are multiple options that are coming so you can select from here.
Let me just select us East one.
Let's press enter.
And now in the browser it took me to the so page, so I can quickly log in here.
Let's sign in.
And all you have to do is you have to click on aloe.
Grid.
So now in the ClA, you see it is asking which is the credentials that I want to configure.
There are two accounts, if you remember, even in the browser we used to see two accounts.
Let's select sandbox account here and I'll just press enter.
And now you see everything is configured.
So it is stating that whenever you want to run a CLI command or you'll have to specify is this profile
parameter.
So if I'll just add this here.
So this will show the listing of the three buckets.
At this stage you're getting empty response primarily because there are no three buckets in this specific
accounts.
However, this command is working perfectly well.
Great.
So this is the CLI integration aspect as well.
Now, generally in most of the medium to large size organizations, you will see single sign on that
has been implemented.
It is not necessary that you have to use the identity center.
In fact, in most of the organizations you will see Identity center is not commonly used.
There are various other more popular solutions like Okta and others that are extensively used now.
I still remember in my initial days where I was working as a system administrator half of the time used
to go into the access management.
You add new users who are joining organization.
If the users are leaving organization, you remove that access and not only removing the access into
the accounts, but also from all the Linux servers, the VPNs and others.
However, after implementing.
So all you'll have to do is you have to remove the access of that user from the solution and everything
is taken care by the single sign on.
And it makes life much more simple.
Now, before we conclude, let's look into some of the benefits of the identity center.
First one is that the users can use the directory credentials for single sign on access to multiple
accounts so no longer users have to maintain different set of username and password for each US accounts.
Note that in larger organizations you can have hundreds of accounts, so you do not really want to remember
the username and password associated with all of them.
So so is a great solution there.
Second is that the identity center also allows you to achieve the single sign on access to your applications
that are running.
You can also achieve a single sign on base access for the easy to Windows instances in case if you have
this is also quite beneficial, you can also enable the single sign on access to cloud based applications
that supports SAML.
We have already seen that there are multiple pre integrated applications that are available.
You can also add your custom applications in case if you'd like.
So this is a very high level overview about the identity center and with this will conclude today's
video.