Important
There are two versions of IAM. If the URL you use to access the IAM UI ends with fireeye.com, this document pertains to you. If the URL you use to access the IAM UI ends with trellix.com, see the Trellix IAM Guide for information regarding IAM.
Identity Access Management (IAM) is a Web service that provides user authentication and authorization. Authentication is the identification of individuals who can use protected resources. Authorization determines who can use which resources and in what ways. Trellix IAM is a multi-tenant Web service that enables you to implement user access control policies for specific resources and prevent unwanted access to other resources. The IAM identity management model enables you to manage user accounts and passwords centrally. Role-based access control policies are used to provision access to users and user groups.
Trellix IAM supports single sign-on (SSO) authentication to your shared resources. See Single Sign-On authentication.
OAuth 2.0 and OIDC
The OAuth 2.0 protocol provides the identity and policy framework on which Trellix IAM implements authorization flows between end users or APIs and Trellix applications and services in the cloud. Trellix IAM manages sessions between users and services by running the OpenID Connect (OIDC) identity layer on top of OAuth 2.0. OIDC performs the transfer of requests and responses using a RESTful HTTP API and JSON-based tokens.
Trellix IAM acts as an OAuth 2.0 authentication server. It implements OIDC to offer authentication as a service. Supported Trellix applications and services send the Trellix IAM authentication server requests to validate end users and APIs. In response to a request for validation, IAM returns an OIDC token that contains the attributes of the end user or API.
Important
OIDC‑based authentication and X.509‑based authentication are mutually exclusive. Trellix IAM uses OIDC-based authentication. If you use Trellix IAM, do not enable the use of Common Access Cards (CAC) or Personal Identity Verification (PIV) smart cards. Both CAC and PIV use the X.509 standard for a Public Key Infrastructure (PKI) as an authentication mechanism to manage certificates.
See Common Access Card (CAC) for certificate authentication.
The IAM organization
Trellix creates a secure account, called an IAM organization, in the Trellix private cloud for each tenant. In this account, you can view your on-premises and cloud-based resources and create and manage user access control policies and user accounts. Credentials are created for each user account in the Trellix IAM organization, and the credentials are used to authenticate end users before they are allowed to access products in the IAM organization.
OIDC clients
To be accessible to your IAM organization, a product must be registered under your IAM organization as an OIDC client and provide information about itself to the Trellix IAM authentication server. End users who enroll in the Trellix IAM service can authenticate to OIDC clients to gain access to their services. OIDC clients can verify the identity of an end user based on the authentication performed by the Trellix IAM authentication and authorization server in the Trellix public cloud. Authenticated users have specific access privileges on specific resource types based on product-specific roles assigned to their accounts.
Trellix IAM release 18.02 supports the following Trellix appliances and services as OIDC clients:
These products automatically register as OIDC clients under your IAM organization.
The default IAM organization administrator
When Trellix creates your IAM organization, a default IAM organization administrator user account is also created and Trellix gives you the credentials. Initially the only user account in a new IAM organization is the IAM organization administrator. The default administrator is assigned the following IAM roles:
IAM Admin―This role enables the user to configure the IAM organization, access control policies, and user accounts. See IAM admin role.
Helix―These roles give the user full access to the incident detection and resolution tracking console. This is described in Entitlements for Helix roles.
Trellix appliances―These roles gives the user full access to all Trellix appliances and services in the IAM organization. This is described in Entitlements for the appliance roles.
Before you can use Trellix IAM authentication and authorization services, the IAM organization administrator must log in to the IAM Web UI and configure the organization and provision user access. The default user credentials were provided to you by Trellix. For additional login information, see IAM Web UI access. Minimum configuration steps are described in IAM initial configuration task list.
Note
The default organization administrator can create IAM Admin users and delegate to them the task of creating the other user accounts.