Managing users and roles for IBM Optim Data Privacy

Edit online

IBM® Optim Data Privacy uses role-based access control (RBAC) to manage permissions across the platform. Roles are defined in Keycloak and enforced through JWT-based authentication.

Administrators can manage user accounts and group memberships using the IBM Optim user interface.

Authentication for IBM Optim is handled by using Keycloak, which supports the following authentication standards and protocols:
  • LDAP
  • SAML
  • OIDC
  • Kerberos

Default user roles

IBM Optim includes the following predefined user roles.
Table 1. User roles
Role Description
optim-admin An administrator user with full system access. Administrators can manage user provisioning. They can perform every workflow-related action and can interact with all resources in the system.
optim-user A basic user who can creates and run workflows. Users can perform every workflow-related action, but:
  • Can only interact with resources that they have created
  • Cannot manage other users

Managing users in Keycloak

To define IBM Optim Data Privacy users in Keycloak:
  1. Navigate to the Keycloak administrator page and log in as the Keycloak administrator. The URL and administrator details are defined in the system's .env configuration file.
  2. Create a user for IBM Optim Data Privacy:
    1. From the Manage realms menu, choose Optim, then select Users > Add user.
    2. Type a username, provide any of the other optional information, then click Create.
    3. Click the Credentials tab, then click Set password.
    4. Select Groups > Join group and choose either admin-group or user-group.
    5. Create an organization and add users:
      1. Select Organization > Create organization. Type the organization name, domain, and description, then click Save.
      2. Click Attribute and add an account-id attribute with a unique or random UUID value (such as data-ai-01/75a10144-c57a-4c0a-889c-22044d012a9a).
      3. Click Members and then choose Add realm user. Choose the user that you want to add to the organization.
The created user can now log in to IBM Optim Data Privacy.

For more information about using Keycloak to manage users, see the Keycloak documentation.

Configuring multifactor authentication (MFA)

Multifactor authentication (MFA) is available but not enabled by default. Administrators can configure MFA policies in Keycloak to require users to provide a second form of verification when they log in.

To enforce MFA for all users globally, configure an OTP authentication flow in Keycloak. For instructions, see Two-factor authentication with OTP in the Red Hat build of Keycloak documentation.

To enforce MFA for specific users only, apply a required action directly to individual user accounts:

  1. In the Keycloak Admin Console, click Users in the left navigation.
  2. Search for and select the user.
  3. On the Details tab, locate the Required User Actions field.
  4. Select Configure OTP and save your changes.

The next time that user logs in, Keycloak requires them to configure an authenticator app.

Managing users in the IBM Optim UI

To manage users by using the IBM Optim UI:

  1. Log in to IBM Optim Data Privacy as an administrator.
  2. Open the Access control tab. From this page, you can manage users and groups:
    View users
    To view users:
    • Review the Users panel to view registered users and groups.
    • Optionally, filter by role or group.
    Add a user
    To add a user:
    1. Click Add user.
    2. Enter the new username and email address, then assign a role.
    3. Optionally, assign the new user to a group.
    4. Assign the new user to an organization.
    Edit user details
    To edit a user:
    1. Select a user and click Edit.
    2. Update the user's role, group membership, or organization.
    Delete a user
    To delete a user:
    1. Select the user and click Delete.
    2. Confirm deletion.